Hi, I have quickly checked out this document: http://www.cisco.com/c/en/us/td/docs/security/firesight/540/api/estreamer/Ev... It seems that it is a protocol that is completely independent of syslog. The connection is established in a reverse direction (e.g. the node that wants to get logs has to establish the connection), then it needs to specify the kind of messages it is interested in and then receive the messages on the same connection. This probably requires a dedicated source driver in syslog-ng. I think the various language bindings would not support this, so it has to be written in C. Alternatively you can write a program that polls these messages and writes them to stdout, which then can be processed by syslog-ng. -- Bazsi On Fri, Jul 28, 2017 at 9:08 PM, Scot <scotrn@gmail.com> wrote:
Has anyone looked at sending Cisco eStreamer events to syslog-ng ?
We have a couple Cisco Firepower management centers and I would rather use syslog-ng over sending directly to splunk so that we may use other integrations like elastic and our NMS.
I have the eStreamer SDK on my syslog-ng server and wondered if anyone else has worked on this. Search of the user archive says no.
Thanks Scot
____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq