[syslog-ng]Cisco Pix configuration
"Pedroche, Raśl"
syslog-ng@lists.balabit.hu
Thu, 10 Jun 2004 08:28:37 +0100
This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.
------=_NextPartTM-000-7dd4242e-2d83-4f64-a286-038ff6585ed5
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C44EBC.8B936F50"
------_=_NextPart_001_01C44EBC.8B936F50
Content-Type: text/plain; charset="iso-8859-1"
There is a catch with Cisco SecurePIX logging facility statement.
The number you have to pass as a parameter is not the number of the
"local" facility, but the low level facility number. local4 is 20, and is
the default. Facility 4 is auth.
See
http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_refer
ence_chapter09186a00801727a9.html#wp1028090
<http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_refe
rence_chapter09186a00801727a9.html#wp1028090>
-----Original Message-----
From: Ben Whittaker [mailto:ben_whittaker@yahoo.com]
Sent: Thursday, June 10, 2004 2:04 AM
To: syslog-ng@lists.balabit.hu
Subject: Re: [syslog-ng]Cisco Pix configuration
Still do not have it worked out.
Please help
Pix
logging on
logging timestamp
logging trap notifications
logging facility 4
logging queue 1024
logging host inside 10.1.1.18
test:/etc/syslog-ng # more syslog-ng.conf
#
# /etc/syslog-ng/syslog-ng.conf
#
# Automatically generated by SuSEconfig on Wed Jun 9 19:16:34 EDT 2004.
#
# PLEASE DO NOT EDIT THIS FILE!
#
# you can modify /etc/syslog-ng/syslog-ng.conf.in instead
#
#
# File format description can be found in syslog-ng.conf(5).
#
options { long_hostnames(off); sync(0); };
#
# 'src' is our main source definition. you can add
# more sources driver definitions to it, or define
# your own sources, i.e.:
#
#source my_src { .... };
source src {
#
# include internal syslog-ng messages
# note: the internal() soure is required!
#
internal();
#
# the following line will be replaced by the
# socket list generated by SuSEconfig using
# variables from /etc/sysconfig/syslog:
#
unix-dgram("/dev/log");
#
# uncomment to process log messages from network:
#
#udp(ip("0.0.0.0") port(514));
};
#
# filter definitions
#
filter f_console { level(warn) and facility(kern) or
level(err) and not facility(authpriv);
};
filter f_newsnotice { level(notice) and facility(news); };
filter f_newscrit { level(crit) and facility(news); };
filter f_newserr { level(err) and facility(news); };
filter f_news { facility(news); };
filter f_mail { facility(mail); };
filter f_cron { facility(cron); };
filter f_warn { level(warn, err, crit); };
filter f_alert ; { level(alert); };
filter f_messages { not facility(news, mail); };
filter f_local { facility(local0, local1, local2, local3,
local4, local5, local6, local7); };
filter f_iptables { facility(kern) and match("IN=") and match("OUT="); };
#
# print most on tty10 and on the xconsole pipe
#
destination console { file("/dev/tty10"); };
log { source(src); filter(f_console); destination(console); };
destination xconsole { pipe("/dev/xconsole"); };
log { source(src); filter(f_console); destination(xconsole); };
# enable this, if you want that root is informed
# immediately, e.g. of logins
#destination root { usertty("root"); };
#log { source(src); filter(f_alert); destination(root); };
#
# these files are rotated and examined by "news.daily"
#
destination newscrit { file("/var/log/news/news.crit"); };
log { source(src); filter(f_newscrit); destination(newscrit); };
destination newserr { file("/var/log/news/news.err"); };
log { source(src); filter(f_newserr); destination(newserr); };
destination newsnotice { file("/var/log/news/news.notice"); };
log { source(src); filter(f_newsnotice); destination(newserr); };
#
# enable this, if you want to keep all news messages
# in one file
#destination news { file("/var/log/news.all"); };
#log { source(src); filter(f_news); destination(news); };
#
# all email-messages in one file
#
destination mail { file("/var/log/mail"); };
log { source(src); filter(f_mail); destination(mail); };
#
# all cron-messages in one file
#
#destination cron { file("/var/log/cron"); };
#log { source(src); filter(f_cron); destination(cron); };
#
# Some boot scripts require local7
#
destination localmessages { file("/var/log/localmessages"); };
log { source(src); filter(f_local); destination(localmessages); };
#
# all messages except the facilities news and mail
#
destination messages { file("/var/log/messages"); };
log { source(src); filter(f_messages); destination(messages); };
#
# enable this, if you want all iptables messages
# in one file
#
#destination firewall { file("/var/log/firewall"); };
#log { source(src); filter(f_iptables); destination(firewall); };
#
# Warnings in one file
#
destination warn { file("/var/log/warn"); };
log { source(src); filter(f_warn); destination(warn); };
#
# enable this, if you want to keep all messages in one file
#destination allmessages { file("/var/log/allmessages"); };
#log { source(src); destination(allmessages); };
# PIX
source network { udp () ; tcp (); };
log{source(network);filter(f_pix);destination(pixlog);};
destination pixlog { file("/var/log/pix.log"); };
filter f_pix { facility(local4); };
test:/etc/syslog-ng #
Bill Nash <billn@billn.net> wrote:
What about your log directives?
log { source(network); destination(pixlog); flags(final); };
- billn
On Wed, 9 Jun 2004, Ben Whittaker wrote:
> Yes, Pix was logging to Kiwi
>
> Bill Nash wrote:
> Stupid question, but:
> Did you configure your PIX to export logs to your log server?
>
> If it behaves like IOS, it's something as simple as:
> logging
>
> - billn
>
> On Wed, 9 Jun 2004, Ben Whittaker wrote:
>
> > How do I setup syslog-ng for cisco pix.
> >
> > I have added the following lines to my config
> >
> > # PIX
> > source network { udp () ; tcp (); };
> >
> > destination pixlog { file("/var/log/pix.log"); };
> >
> > filter f_pix { facility(local4); };
> >
> >
> >
> > but I am not getting any logging to this new syslog server.
> >
> >
> >
> >
> > __________________________________
> > Do you Yahoo!?
> > Friends. Fun. Try the all-new Yahoo! Messenger.
> > http://messenger.yahoo.com/
> > _______________________________________________
> > syslog-ng maillist - syslog-ng@lists.balabit.hu
> > https://lists.balabit.hu/mailman/listinfo/syslog-ng
> > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
> >
>
> _______________________________________________
> syslog-ng maillist - syslog-ng@lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
>
>
>
> ---------------------------------
> Do you Yahoo!?
> Friends . Fun. Try the all-new Yahoo! Messenger
_______________________________________________
syslog-ng maillist - syslog-ng@lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
_____
Do you Yahoo!?
Friends. Fun. Try the all-new Yahoo! <http://messenger.yahoo.com/>
Messenger
**********************************************************************
COLT Telecom Espana S.A.
Oficina Registrada en: Telemaco, 5 28027 Madrid
Tel. +34 91 789 9000
This message is subject to and does not create or vary any contractual
relationship between COLT Telecommunications, its subsidiaries or
affiliates ("COLT") and you. Internet communications are not secure
and therefore COLT does not accept legal responsibility for the
contents of this message. Any view or opinions expressed are those of
the author. The message is intended for the addressee only and its
contents and any attached files are strictly confidential. If you have
received it in error, please telephone the number above. Thank you.
**********************************************************************
------_=_NextPart_001_01C44EBC.8B936F50
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; charset=3Diso-8859-=
1">
<TITLE>Mensaje</TITLE>
<META content=3D"MSHTML 6.00.2800.1400" name=3DGENERATOR></HEAD>
<BODY>
<DIV><FONT face=3DArial color=3D#0000ff size=3D2> There is a catch wi=
th Cisco=20
SecurePIX logging facility statement.</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=3DArial><FONT color=3D#0000ff><FONT size=3D2> The num=
ber you=20
have to pass as a parameter is not the number of the "local" facility, but =
the=20
low level facility number. local4 is 20, and is the default.<SPAN=20
class=3D973502607-10062004> Facility 4 is auth.</SPAN></FONT></FONT></FONT>=
</DIV>
<DIV><FONT face=3DArial color=3D#0000ff size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial color=3D#0000ff size=3D2> See<BR><A=20
href=3D"http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_comm=
and_reference_chapter09186a00801727a9.html#wp1028090">http://www.cisco.com/=
en/US/products/sw/secursw/ps2120/products_command_reference_chapter09186a00=
801727a9.html#wp1028090</A><BR></FONT></DIV>
<BLOCKQUOTE style=3D"MARGIN-RIGHT: 0px">
<DIV></DIV>
<DIV class=3DOutlookMessageHeader lang=3Des dir=3Dltr align=3Dleft><FONT =
face=3DTahoma=20
size=3D2>-----Original Message-----<BR><B>From:</B> Ben Whittaker=20
[mailto:ben_whittaker@yahoo.com] <BR><B>Sent:</B> Thursday, June 10, 2004=
2:04=20
AM<BR><B>To:</B> syslog-ng@lists.balabit.hu<BR><B>Subject:</B> Re:=20
[syslog-ng]Cisco Pix configuration<BR><BR></FONT></DIV>
<DIV>Still do not have it worked out.</DIV>
<DIV> </DIV>
<DIV>Please help</DIV>
<DIV> </DIV>
<DIV>Pix</DIV>
<DIV> </DIV>
<DIV>logging on<BR>logging timestamp<BR>logging trap notifications<BR>log=
ging=20
facility 4<BR>logging queue 1024<BR>logging host inside 10.1.1.18<BR></DI=
V>
<DIV> </DIV>
<DIV><BR>test:/etc/syslog-ng # more syslog-ng.conf<BR>#<BR>#=20
/etc/syslog-ng/syslog-ng.conf<BR>#<BR># Automatically generated by SuSEco=
nfig=20
on Wed Jun 9 19:16:34 EDT 2004.<BR>#<BR># PLEASE DO NOT EDIT THIS=
FILE!<BR>#<BR># you can modify /etc/syslog-ng/syslog-ng.conf.in=20
instead<BR>#<BR>#<BR># File format description can be found in=20
syslog-ng.conf(5).<BR>#</DIV>
<DIV>options { long_hostnames(off); sync(0); };</DIV>
<DIV>#<BR># 'src' is our main source definition. you can add<BR># more so=
urces=20
driver definitions to it, or define<BR># your own sources,=20
i.e.:<BR>#<BR>#source my_src { .... };</DIV>
<DIV>source src {<BR> =20
#<BR> # include internal syslog=
-ng=20
messages<BR> # note: the intern=
al()=20
soure is required!<BR> =20
#<BR> internal();</DIV>
<DIV> =20
#<BR> # the following line will=
be=20
replaced by the<BR> # socket li=
st=20
generated by SuSEconfig using<BR> &nbs=
p; #=20
variables from=20
/etc/sysconfig/syslog:<BR> =20
#<BR> unix-dgram("/dev/log");</=
DIV>
<DIV> =20
#<BR> # uncomment to process lo=
g=20
messages from network:<BR> =20
#<BR> #udp(ip("0.0.0.0")=20
port(514));<BR>};</DIV>
<DIV><BR>#<BR># filter definitions<BR>#<BR>filter f_console &n=
bsp;=20
{ level(warn) and facility(kern)=20
or<BR> &=
nbsp; =20
level(err) and not=20
facility(authpriv);<BR> &n=
bsp; =20
};<BR>filter f_newsnotice { level(notice) and facility(news); };<BR>filte=
r=20
f_newscrit { level(crit) and facility(news);=20
};<BR>filter f_newserr { level(err) a=
nd=20
facility(news); };<BR>filter f_news {=
facility(news); };<BR>filter f_mail =
{=20
facility(mail); };<BR>filter f_cron {=
facility(cron); };<BR>filter f_warn =
{=20
level(warn, err, crit); };<BR>filter f_alert  =
; ; {=20
level(alert); };<BR>filter f_messages { not facility(news, ma=
il);=20
};<BR>filter f_local { facility(local0, loc=
al1,=20
local2,=20
local3,<BR> &n=
bsp;  =
; =20
local4, local5, local6, local7); };<BR>filter f_iptables {=20
facility(kern) and match("IN=3D") and match("OUT=3D"); };</DIV>
<DIV><BR>#<BR># print most on tty10 and on the xconsole=20
pipe<BR>#<BR>destination console { file("/dev/tty10"); };<BR>log {=20
source(src); filter(f_console); destination(console); };</DIV>
<DIV>destination xconsole { pipe("/dev/xconsole"); };<BR>log { source(src=
);=20
filter(f_console); destination(xconsole); };</DIV>
<DIV># enable this, if you want that root is informed<BR># immediately, e=
.g.=20
of logins<BR>#destination root { usertty("root"); };<BR>#log { source(src=
);=20
filter(f_alert); destination(root); };</DIV>
<DIV><BR>#<BR># these files are rotated and examined by=20
"news.daily"<BR>#<BR>destination newscrit { file("/var/log/news/news.crit=
");=20
};<BR>log { source(src); filter(f_newscrit); destination(newscrit); };</D=
IV>
<DIV>destination newserr { file("/var/log/news/news.err"); };<BR>log {=20
source(src); filter(f_newserr); destination(newserr); };</DIV>
<DIV>destination newsnotice { file("/var/log/news/news.notice"); };<BR>lo=
g {=20
source(src); filter(f_newsnotice); destination(newserr); };</DIV>
<DIV>#<BR># enable this, if you want to keep all news messages<BR># in on=
e=20
file<BR>#destination news { file("/var/log/news.all"); };<BR>#log {=20
source(src); filter(f_news); destination(news); };</DIV>
<DIV><BR>#<BR># all email-messages in one file<BR>#<BR>destination mail {=
file("/var/log/mail"); };<BR>log { source(src); filter(f_mail);=20
destination(mail); };</DIV>
<DIV>#<BR># all cron-messages in one file<BR>#<BR>#destination cron {=20
file("/var/log/cron"); };<BR>#log { source(src); filter(f_cron);=20
destination(cron); };</DIV>
<DIV><BR>#<BR># Some boot scripts require local7<BR>#<BR>destination=20
localmessages { file("/var/log/localmessages"); };<BR>log { source(src);=
filter(f_local); destination(localmessages); };</DIV>
<DIV><BR>#<BR># all messages except the facilities news and=20
mail<BR>#<BR>destination messages { file("/var/log/messages"); };<BR>log =
{=20
source(src); filter(f_messages); destination(messages); };</DIV>
<DIV><BR>#<BR># enable this, if you want all iptables messages<BR># in on=
e=20
file<BR>#<BR>#destination firewall { file("/var/log/firewall"); };<BR>#lo=
g {=20
source(src); filter(f_iptables); destination(firewall); };</DIV>
<DIV><BR>#<BR># Warnings in one file<BR>#<BR>destination warn {=20
file("/var/log/warn"); };<BR>log { source(src); filter(f_warn);=20
destination(warn); };</DIV>
<DIV><BR>#<BR># enable this, if you want to keep all messages in one=20
file<BR>#destination allmessages { file("/var/log/allmessages"); };<BR>#l=
og {=20
source(src); destination(allmessages); };</DIV>
<DIV># PIX<BR>source network { udp () ; tcp (); };</DIV>
<DIV>log{source(network);filter(f_pix);destination(pixlog);};</DIV>
<DIV><BR>destination pixlog { file("/var/log/pix.log"); };</DIV>
<DIV>filter f_pix { facility(local4); };<BR>test:/etc/syslog-ng=20
#<BR><BR><BR><B><I>Bill Nash <billn@billn.net></I></B> wrote:</DIV>
<BLOCKQUOTE class=3Dreplbq=20
style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #1010ff 2px so=
lid"><BR>What=20
about your log directives?<BR><BR>log { source(network);=20
destination(pixlog); flags(final); };<BR><BR>- billn<BR><BR><BR>On Wed,=
9=20
Jun 2004, Ben Whittaker wrote:<BR><BR>> Yes, Pix was logging to=20
Kiwi<BR>><BR>> Bill Nash <BILLN@BILLN.NET>wrote:<BR>> Stupid=
question, but:<BR>> Did you configure your PIX to export logs to yo=
ur log=20
server?<BR>><BR>> If it behaves like IOS, it's something as simpl=
e=20
as:<BR>> logging<BR>><BR>> - billn<BR>><BR>> On Wed, 9 J=
un=20
2004, Ben Whittaker wrote:<BR>><BR>> > How do I setup syslog-n=
g for=20
cisco pix.<BR>> ><BR>> > I have added the following lines t=
o my=20
config<BR>> ><BR>> > # PIX<BR>> > source network { ud=
p ()=20
; tcp (); };<BR>> ><BR>> > destination pixlog {=20
file("/var/log/pix.log"); };<BR>> ><BR>> > filter f_pix {=
facility(local4); };<BR>> ><BR><BR><BR>> ><BR>> ><BR=
>>=20
> but I am not getting any logging to this new syslog server.<BR>>=
;=20
><BR>> ><BR>> ><BR>> ><BR>> >=20
__________________________________<BR>> > Do you Yahoo!?<BR>> =
>=20
Friends. Fun. Try the all-new Yahoo! Messenger.<BR>> >=20
http://messenger.yahoo.com/<BR>> >=20
_______________________________________________<BR>> > syslog-ng=
maillist - syslog-ng@lists.balabit.hu<BR>> >=20
https://lists.balabit.hu/mailman/listinfo/syslog-ng<BR>> > Freque=
ntly=20
asked questions at http://www.campin.net/syslog-ng/faq.html<BR>>=20
><BR>><BR>> _______________________________________________<BR=
>>=20
syslog-ng maillist - syslog-ng@lists.balabit.hu<BR>>=20
https://lists.balabit.hu/mailman/listinfo/syslog-ng<BR>> Frequently =
asked=20
questions at=20
http://www.campin.net/syslog-ng/faq.html<BR>><BR>><BR>><BR>>=
;=20
---------------------------------<BR>> Do you Yahoo!?<BR>> Friend=
s .=20
Fun. Try the all-new Yahoo!=20
Messenger<BR><BR>_______________________________________________<BR>sys=
log-ng=20
maillist -=20
syslog-ng@lists.balabit.hu<BR>https://lists.balabit.hu/mailman/listinfo=
/syslog-ng<BR>Frequently=20
asked questions at http://www.campin.net/syslog-ng/faq.html<BR></BLOCKQ=
UOTE>
<P>
<HR SIZE=3D1>
<FONT face=3Darial size=3D-1>Do you Yahoo!?<BR>Friends. Fun. <A=20
href=3D"http://messenger.yahoo.com/">Try the all-new Yahoo!=20
Messenger</A></FONT></BLOCKQUOTE><FONT SIZE=3D3><BR>
<BR>
**********************************************************************<BR>
COLT Telecom Espana S.A.<BR>
Oficina Registrada en: Telemaco, 5 28027 Madrid<BR>
Tel. +34 91 789 9000<BR>
<BR>
This message is subject to and does not create or vary any contractual<BR>
relationship between COLT Telecommunications, its subsidiaries or <BR>
affiliates ("COLT") and you. Internet communications are not secure<BR>
and therefore COLT does not accept legal responsibility for the<BR>
contents of this message. Any view or opinions expressed are those of<BR>
the author. The message is intended for the addressee only and its<BR>
contents and any attached files are strictly confidential. If you have<BR>
received it in error, please telephone the number above. Thank you.<BR>
<BR>
**********************************************************************<BR>
</FONT>
</BODY></HTML>
------_=_NextPart_001_01C44EBC.8B936F50--
------=_NextPartTM-000-7dd4242e-2d83-4f64-a286-038ff6585ed5--