topic Re: Expedition as a Syslog server in Expedition Discussions

Expedition as a Syslog server

tnamba_evotek — Thu, 13 Apr 2023 16:00:48 GMT

Hi all, I'm trying to set up Expedition as a Syslog server. I am following the guides, but a folder under /PALogs is never created with the management IP of firewall sending the logs. Any suggestions?

Re: Expedition as a Syslog server

lychiang — Thu, 13 Apr 2023 16:38:45 GMT

Hi @tnamba_evotek If /PALogs folder does not exist, you will need to manually create them in the Expedition. Please review the tutorial video https://youtu.be/Ozjx0rfRRmI

Re: Expedition as a Syslog server

tnamba_evotek — Thu, 13 Apr 2023 16:54:33 GMT

/PALogs directory is there, but the directory under that never gets created with the management IP of the firewall (10.0.0.1). I tried creating the 10.0.0.1 directory manually, but no logs ever get populated.

Re: Expedition as a Syslog server

lychiang — Thu, 13 Apr 2023 16:57:34 GMT

@tnamba_evotek The subfolder should be auto created when Expedition received syslog from firewall. You can try to use "chmod" to change the folder permission, so firewall can write to it , all those are in the tutorial video .

Re: Expedition as a Syslog server

tnamba_evotek — Thu, 13 Apr 2023 17:10:52 GMT

That is my issue, it is not getting created automatically and when I manually create it, the logs never show up. I used chmod and chown to mirror the /PALogs directory permission and ownership to the 10.0.0.1 directory.

Re: Expedition as a Syslog server

lychiang — Thu, 13 Apr 2023 17:32:23 GMT

@tnamba_evotek Make sure you have modified

/var/www/html/OS/rsyslog/rsyslog.conf to be like the sample in the same directory , for example, if you are sending the syslog in udp , you will reference the rsyslog.default-udp in the same directory, double check below:

1. You have added your firewallIPs as allowed list in the section of the rsyslog.conf

# specify senders you permit to access

$AllowedSender TCP, 127.0.0.1, 10.11.29.0/24, 172.16.26.0/24, *.paloaltonetworks (add your firewall IPs)

.com

$AllowedSender UDP, 127.0.0.1, 10.11.29.0/24, 172.16.26.0/24, *.paloaltonetworks (add your firewall IPs)

.com

2. In the below section, make sure the folder is /PALogs and the folder exist in your system: (Folder name is Case sensitive)

$template DynaTrafficLog,"/PALogs/%FROMHOST-IP%/%HOSTNAME%_traffic_%$YEAR%_%$MON

TH%_%$DAY%_last_calendar_day.csv"

3. After modify and save the file, make sure you restart the VM

Re: Expedition as a Syslog server

tnamba_evotek — Sat, 15 Apr 2023 23:40:19 GMT

Yes, that is all in the guide which I followed.