.. _syslog:

Syslog Settings
~~~~~~~~~~~~~~~

It's possible to have StoredSafe send appliance information to a remote syslog server. By default it's disabled.

::

    ┌────────────────────────────────────────────────────────────────────────────┐
    │              Network Settings on node1 (Version 2.0.X build XXXX)          │
    └────────────────────────────────────────────────────────────────────────────┘

    ┌─┬──────────────────────────────────────────────────────────────────────────┐
    │1│View the remote syslog settings                                           │
    │2│Change the remote syslog host                                             │
    │3│Change the remote syslog port                                             │
    │4│Change the remote syslog protocol (UDP or TCP)                            │
    │5│Enable or Disable remote syslog                                           │
    │6│Restart the syslog server                                                 │
    │7│Log level for remote logging                                              │
    └─┴──────────────────────────────────────────────────────────────────────────┘

    Move the cursor or enter a it's corresponding number (Q to Quit)              

    Main> System Settings> Network> Syslog>

View the remote syslog settings
###############################

Check the status on sending system logs to a remote syslog server.
Shows current remote syslog status (host, port and protocol).

::

    Remote syslog is DISABLED.

    Press any key to continue

Change the remote syslog host
#############################

Configure what remote syslog server to use. Currently only one remote syslog server is supported.

::

    Specify remote syslog server? (Q to Quit) <none>: 192.168.1.124

    Press any key to continue

Change the remote syslog port
#############################

If the remote syslog server is listening on a non default port, it can be specified here.

::

    Specify port for remote syslog server? (Q to Quit) <none>: 514

    Press any key to continue

Change the remote syslog protocol (UDP or TCP)
##############################################

It's possible to send syslog via UDP (default) or TCP.

::

    Specify protocol for remote syslog server? (UDP or TCP) (Q to Quit) <udp>: tcp

    Press any key to continue

Enable or Disable remote syslog
###############################

Enable or disable the sending of logs to a remote server.

::

    Remote syslog is DISABLED.

    Enable remote syslog? (<Y>/n): 
    Restart syslog to activate changes? (<Y>/n): 

    rsyslog stop/waiting
    rsyslog start/running, process 2872

    Remote syslog is ENABLED.
    Remote syslog server is set to 192.168.1.124 on port 514 using udp.

    Press any key to continue

Restart the syslog server
#########################

Restart the local syslog server.

::

    rsyslog stop/waiting
    rsyslog start/running, process 2928
    Remote syslog is ENABLED.
    Remote syslog server is set to 192.168.1.124 on port 514 using udp.

    Press any key to continue

Log level for remote logging
############################

Specify if decrypts should be be sent to the remote syslog server. By default, only objects
marked with "Alert if decrypted" logged, with this setting all decrypts are logged and
sent to the remote syslog server.

.. note:: The decrypted content is never logged.

If disabled:

::

    Log all decrypts to the remote syslog server "10.6.1.2"? (<Y>/n):

    Press any key to continue

If enabled:

::

    Stop logging all decrypts to the remote syslog server "10.6.1.2"? (<Y>/n):

    Press any key to continue

**Example**

::

    Jun 23 17:21:46 stored.safe.cc storedsafe[10744]: "action=alarm" what="x509 (2391)" user="Sven Svensson (29)" source="10.2.9.7"
    Jun 23 17:21:53 stored.safe.cc storedsafe[30747]: "action=alarm-decrypted" what="Emergency use only (1339)" user="Ulrich Bauer (29)" source="10.200.1.89"