Firewall / Panorama traffic-log via Syslog to Expedition

[bebe5001]

Hello,

i'm forwarding at the moment traffic logs from Palo Firewalls and Panorama to the Expedition server. I verified with tcpdump that the Expedition-Server recieves the syslogs. Expedition is up to date. 

I modified the configuration files in "/var/www/html/OS/rsyslog" like described in the "Expedition Log Analysis Guide v1.0". 

I also changed the user permission for the folder like described in the "Expedition Log Analysis Guide v1.0".

But i don't see any created traffic-log-files for analysis.

I also restarted the rsyslog daemon multiple times without any result.

Do you have any idea or something that i should check to solve this problem?

Best regards,

Ben

[alestevez]

Maybe the local Firewall?

sudo /usr/bin/firewall-cmd --permanent --add-port=514/udp
sudo /usr/bin/firewall-cmd --permanent --add-port=514/tcp

[bebe5001]

Thanks for the help, but it didn't fix my problem. I checked the server once again and the Syslog-Messages are coming to the server but they appear in the following folder /var/log and in the following files syslog and syslog.1. Usually they should be in /data like it is configured in my rsyslog.default-tcpudp.conf file.

So it seems, that my server uses the wrong configuration file for rsyslog.

Does someone know where i can verify which configuration file is used by rsyslog?

[alestevez · Accepted solution]

You should have to replace the one comes from the OS in /etc/rsyslog.d with the one is provided within Expedition rsyslog.default-tcpudp.conf, then restart the service or the VM....