<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<!-- Template generated by Exclaimer Signature Manager Exchange Edition on 03:36:24 Friday, 24 February 2017 -->
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css">P.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
LI.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
DIV.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
TABLE.ImprintUniqueIDTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style>
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="#0563C1" vlink="#954F72">
<br>
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US">Have you disabled any other syslog servers that might be listening on UDP 514? Rsyslog, etc? (ps aux | grep syslog) Try (temporarily) disabling SELINUX and keep firewall turned off.
See if you can start syslog-ng in the foreground and see what you get (syslog-ng –Fed)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div></div>
</div>
<br>
<br>
<table class="ImprintUniqueIDTable" style="BORDER-COLLAPSE: collapse; WIDTH: 100%" cellspacing="0" cellpadding="0" border="0">
<tbody>
<tr>
<td><font style="font-family:Calibri;font-size:10pt;color:#595959;font-weight:bold;">Damian</font> <font style="font-family:Calibri;font-size:10pt;color:#595959;font-weight:bold;">Bell</font><br>
<font style="font-family:Calibri;font-size:10pt;color:#595959;">Infrastructure Engineer</font><font style="font-family:Calibri;font-size:10pt;color:#595959;"> |
</font><font style="font-family:Calibri;font-size:10pt;color:#595959;">Support</font><font style="font-family:Calibri;font-size:10pt;color:#595959;"> |
</font><font style="font-family:Calibri;font-size:10pt;color:#595959;">H Clarkson & Co Ltd</font></td>
</tr>
<tr>
<td><br>
<font style="font-family:Calibri;font-size:10pt;color:#404040;">Email: </font><span style="font-family:Calibri;font-size:10pt;color:#0070C0;"><a href="mailto:Damian.Bell@clarksons.com" title="Click to send email to Damian Bell" target="" style="font-family:Calibri;font-size:10pt;color:#0070C0;"><span style="font-family:Calibri; font-size:10pt; color:#0070C0;">Damian.Bell@clarksons.com</span></a></span></td>
</tr>
</tbody>
</table>
<br>
<br>
<div class="WordSection1">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> syslog-ng [mailto:syslog-ng-bounces@lists.balabit.hu]
<b>On Behalf Of </b>Tim Tyler<br>
<b>Sent:</b> 24 February 2017 15:07<br>
<b>To:</b> syslog-ng@lists.balabit.hu<br>
<b>Subject:</b> [syslog-ng] Can't get basic syslog to work for my firewall logs?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US">Syslog-ng experts.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> I am very new to syslog-ng. I installed syslog-ng on a fresh Redhat 7.3 server. It defaults working with internal logging. So I configured my firewall to send syslog with facility set to log_user. I turned on Wireshark
on the syslog-ng server and observed the firewall sending traffic to the server on udp 514.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">But the syslog server never created the directory structure and logs. I disabled the redhat firewall just to eliminate it as a possibility. Still no logging. So I don’t know what I am doing wrong at this point. I don’t
know if this is a permission problem or some other configuration issue. I found someone that had posted a very basic syslog-ng configuration for firewalls. So I copied It into a firewall.conf I put in conf.d. Can anyone see what might be wrong with it?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">####################<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">options {<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> create_dirs(yes);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> owner(root);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> group(root);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> perm(0640);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> dir_owner(root);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> dir_group(root);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> dir_perm(0750);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">};<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">##################################################<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">source s_udp {<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> udp(port(514));<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">};<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">#Template for a new firewall in the firewalls.conf file<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">#Entries to be changed: NAMEOFTHEFIREWALL and IPOFTHEFIREWALL<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">##################################################<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">filter f_NAMEOFTHEFIREWALL {<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> host("192.168.30.1");<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">};<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">destination d_NAMEOFTHEFIREWALL {<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> file("/var/log/firewalls/PA/$YEAR/$MONTH/$YEAR-$MONTH-$DAY.PA.log");<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">};<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">log {<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> source(s_udp);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> filter(f_NAMEOFTHEFIREWALL);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> destination(d_NAMEOFTHEFIREWALL);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">};<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Tim Tyler<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Network Engineer<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Beloit College<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
</div>
<p class="ImprintUniqueID"><font size="1"></p>
<hr>
</font><font face="Microsoft Sans Serif" size="1">This message is private and confidential. If you have received it in error, you are on notice of its status. Please notify us immediately by reply email and then delete this message from your system. Please
do not copy it or use it for any purposes, or disclose its contents to any other person: to do so could be a breach of confidence.<br>
<br>
</font><font face="Microsoft Sans Serif" size="1">Emails may be monitored.<br>
<br>
Details of Clarkson group companies and their regulators (where applicable) can be found at this url:
</font><a title="Disclosure" href="http://www.clarksons.com/disclosure/"><font face="Microsoft Sans Serif" size="1">Disclosure</font></a>
<hr>
<p></p>
</body>
</html>