Syslog Settings¶
It’s possible to have StoredSafe send appliance information to a remote syslog server. By default it’s disabled.
┌────────────────────────────────────────────────────────────────────────────┐
│ Network Settings on node1 (Version 2.0.X build XXXX) │
└────────────────────────────────────────────────────────────────────────────┘
┌─┬──────────────────────────────────────────────────────────────────────────┐
│1│View the remote syslog settings │
│2│Change the remote syslog host │
│3│Change the remote syslog port │
│4│Change the remote syslog protocol (UDP or TCP) │
│5│Enable or Disable remote syslog │
│6│Restart the syslog server │
│7│Log level for remote logging │
└─┴──────────────────────────────────────────────────────────────────────────┘
Move the cursor or enter a it's corresponding number (Q to Quit)
Main> System Settings> Network> Syslog>
View the remote syslog settings¶
Check the status on sending system logs to a remote syslog server. Shows current remote syslog status (host, port and protocol).
Remote syslog is DISABLED.
Press any key to continue
Change the remote syslog host¶
Configure what remote syslog server to use. Currently only one remote syslog server is supported.
Specify remote syslog server? (Q to Quit) <none>: 192.168.1.124
Press any key to continue
Change the remote syslog port¶
If the remote syslog server is listening on a non default port, it can be specified here.
Specify port for remote syslog server? (Q to Quit) <none>: 514
Press any key to continue
Change the remote syslog protocol (UDP or TCP)¶
It’s possible to send syslog via UDP (default) or TCP.
Specify protocol for remote syslog server? (UDP or TCP) (Q to Quit) <udp>: tcp
Press any key to continue
Enable or Disable remote syslog¶
Enable or disable the sending of logs to a remote server.
Remote syslog is DISABLED.
Enable remote syslog? (<Y>/n):
Restart syslog to activate changes? (<Y>/n):
rsyslog stop/waiting
rsyslog start/running, process 2872
Remote syslog is ENABLED.
Remote syslog server is set to 192.168.1.124 on port 514 using udp.
Press any key to continue
Restart the syslog server¶
Restart the local syslog server.
rsyslog stop/waiting
rsyslog start/running, process 2928
Remote syslog is ENABLED.
Remote syslog server is set to 192.168.1.124 on port 514 using udp.
Press any key to continue
Log level for remote logging¶
Specify if decrypts should be be sent to the remote syslog server. By default, only objects marked with “Alert if decrypted” logged, with this setting all decrypts are logged and sent to the remote syslog server.
Note
The decrypted content is never logged.
If disabled:
Log all decrypts to the remote syslog server "10.6.1.2"? (<Y>/n):
Press any key to continue
If enabled:
Stop logging all decrypts to the remote syslog server "10.6.1.2"? (<Y>/n):
Press any key to continue
Example
Jun 23 17:21:46 stored.safe.cc storedsafe[10744]: "action=alarm" what="x509 (2391)" user="Sven Svensson (29)" source="10.2.9.7"
Jun 23 17:21:53 stored.safe.cc storedsafe[30747]: "action=alarm-decrypted" what="Emergency use only (1339)" user="Ulrich Bauer (29)" source="10.200.1.89"