<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Dear all,</div>
<div> </div>
<div> When use: tcpdump src host 1.3.4.5 and port 514 , I can see host 1.3.4.5 is sending the syslog to my syslog-ng </div>
<div>But when I search my local log special for port 514, I didn’t see any syslog from 1.3.4.5</div>
<div> </div>
<div>Is there another location to config the syslog-ng, except /app/syslog-ng/custom/conf/syslog-ng.conf ?</div>
<div><font face="Times New Roman"> </font></div>
<div>Below is from my syslog-ng.conf</div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"># Syslog collection for all devices </span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;">source s_network {</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"> network(</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"> transport("udp")</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"> port(514)</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"> flags(syslog_protocol)</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"> keep_hostname(yes)</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"> keep_timestamp(yes)</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"> use_dns(no)</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"> use_fqdn(no)</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"> );</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;">};</span></font></div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;">destination d_all_logs {</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"> file("/app/syslog-ng/custom/output/all_devices.log");</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"> network("102.45.2.86" port(514) transport(udp) spoof_source(yes));</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"> </span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;">};</span></font></div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;">log {</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"> source(s_network);</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"> source(s_arista_network);</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;"> destination(d_all_logs);</span></font></div>
<div><font size="1" color="#00B0F0"><span style="font-size:8pt;">};</span></font></div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
<div>Thank you very much for reply in advance!!!!!</div>
<div> </div>
<div>VL</div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Arial" size="2" color="#1F4E79"><span style="font-size:10pt;"> </span></font></div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
</span></font>
<P><font style="FONT-SIZE: 9pt">_______________________________________________________________________</font></P>
<P><font style="FONT-SIZE: 9pt">If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference.</font></P>
<P><font style="FONT-SIZE: 9pt">Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future. </font></P>
<P></P></body>
</html>