topic Firewall / Panorama traffic-log via Syslog to Expedition in Expedition Discussions

Firewall / Panorama traffic-log via Syslog to Expedition

bebe5001 — Fri, 19 Oct 2018 13:56:19 GMT

Hello,

i'm forwarding at the moment traffic logs from Palo Firewalls and Panorama to the Expedition server. I verified with tcpdump that the Expedition-Server recieves the syslogs. Expedition is up to date.

I modified the configuration files in "/var/www/html/OS/rsyslog" like described in the "Expedition Log Analysis Guide v1.0".

I also changed the user permission for the folder like described in the "Expedition Log Analysis Guide v1.0".

But i don't see any created traffic-log-files for analysis.

I also restarted the rsyslog daemon multiple times without any result.

Do you have any idea or something that i should check to solve this problem?

Best regards,

Ben

Re: Firewall / Panorama traffic-log via Syslog to Expedition

alestevez — Fri, 19 Oct 2018 14:01:17 GMT

Maybe the local Firewall?

sudo /usr/bin/firewall-cmd --permanent --add-port=514/udp
sudo /usr/bin/firewall-cmd --permanent --add-port=514/tcp

Re: Firewall / Panorama traffic-log via Syslog to Expedition

bebe5001 — Mon, 22 Oct 2018 09:53:14 GMT

Thanks for the help, but it didn't fix my problem. I checked the server once again and the Syslog-Messages are coming to the server but they appear in the following folder /var/log and in the following files syslog and syslog.1. Usually they should be in /data like it is configured in my rsyslog.default-tcpudp.conf file.

So it seems, that my server uses the wrong configuration file for rsyslog.

Does someone know where i can verify which configuration file is used by rsyslog?

Re: Firewall / Panorama traffic-log via Syslog to Expedition

alestevez — Mon, 22 Oct 2018 10:04:14 GMT

You should have to replace the one comes from the OS in /etc/rsyslog.d with the one is provided within Expedition rsyslog.default-tcpudp.conf, then restart the service or the VM....