topic Traffic logs filter on syslog in General Topics

Traffic logs filter on syslog

johnde — Wed, 01 Apr 2020 13:31:06 GMT

Hello team,

We are sending all the traffic logs to our inhouse syslog servers. So whatever traffic is matching current security policies, all such traffic logs are forwarded to syslog server. Now in those logs, i am seeing everything like Source, Destination, port everything. Now our requirement, we need to send only specific logs to syslog for specific traffic. e.g. dont want to disclose source IP. How can i configure this?

Pls suggest.

Re: Traffic logs filter on syslog

SutareMayur — Wed, 01 Apr 2020 13:50:13 GMT

@johnde,

I think you are looking for FILTER BUILDER under Log Forwarding Profiles. By default, it select 'All Logs' under Filter. But you can create custom filter as per your requirement. PFB snap for your ref. Once you create Filter, attach that Log Forwarding Profile to required security policies.

Hope it helps!

Mayur

Re: Traffic logs filter on syslog

kiwi — Wed, 01 Apr 2020 14:00:12 GMT

Hi @johnde ,

What @SutareMayur mentions will work and is very granular.

If you want to customize for your syslog-server you can also do this:

Goto your syslog server profile on the Device tab. There's a Custom Log Format tab ... click the Traffic one :

Add the field you want :

Hope this helps,

Kiwi.

Re: Traffic logs filter on syslog

johnde — Wed, 01 Apr 2020 15:05:30 GMT

@SutareMayur ,

Thanks Mayur, i will try it.

Re: Traffic logs filter on syslog

johnde — Wed, 01 Apr 2020 15:07:38 GMT

@kiwi hey, thanks much! I will try this also.

Will keep you posted.

Re: Traffic logs filter on syslog

SutareMayur — Wed, 01 Apr 2020 16:15:50 GMT

Yes, this is very helpful when you have multiple syslog servers and you want to filter specific logs fields for specific syslog server only.

@kiwiThanks for sharing this too.

Mayur

Re: Traffic logs filter on syslog

johnde — Thu, 02 Apr 2020 10:35:15 GMT

@SutareMayur @kiwi ,

Thanks for all your suggestions and inputs. I did try both the configurations and both works for me.

Appreciate your help!