Syslog

A Tracix Collector can listen for syslog from your network devices, firewalls and servers, and store each message as a structured log in your workspace. Use the Syslog integration for any device that sends standard syslog, or a vendor integration for a device Tracix knows how to parse.

Set up syslog

1. 1

   Open the connect steps

   In your workspace, open Collectors › Integrations and select the Syslog tile, under Logs & Events.

2. 2

   Choose the collectors

   Syslog goes to your own collectors. Under Where to add this integration, pick the policy of the collectors your devices will send to, or create one.

3. 3

   Choose the format and transport

   Set Format to RFC 5424 (modern), the default, or RFC 3164 (BSD). For RFC 3164, which has no time zone in its timestamps, set Timezone under the advanced settings. Set Transport to udp, the default, or tcp.

4. 4

   Choose the port

   Listen address defaults to 0.0.0.0:514. Use a port of 1024 or above on collectors that can't open low ports; see below.

5. 5

   Connect and point your devices at it

   Select Review, then Connect. Then set each device's syslog destination to a collector's address on that port and transport, and allow the port through the host's firewall.

Each integration listens on one transport. To receive both UDP and TCP, add a second Syslog integration with a different name. For TCP senders that frame messages by length, turn on Octet counting (RFC 6587). The integration has no TLS option.

Ports below 1024

A collector that can't open a port below 1024 isn't given a listener there; its other integrations keep running.

• Linux hosts installed before the installer granted that permission need the current installer run once.
• Kubernetes collectors on the chart's default profile can't bind 514. Listen on 0.0.0.0:1514 and send to the node on 1514, or redirect 514 to 1514 on every node.
• Docker collectors need the listen port published when you run them, such as -p 514:514/udp for the default; the console's command publishes only the SNMP trap port.
• Windows collectors are covered by the firewall rule the installer adds.

How syslog is parsed

The collector parses the syslog header and keeps the message. Fields get standard names:

To parse the message itself further, edit the log pipeline for the syslog dataset under Settings › Data Management › Pipelines. See Logs and pipelines.

Vendor log integrations

Vendor integrations listen on their own port and parse that vendor's messages into fields with a pipeline built for them. Each one stores its logs in a dataset named after the integration. Some network examples, with their default UDP ports:

Find them, and many security products, in the integrations catalog. They need a recent collector: older collectors aren't given these integrations until they are upgraded.

Find your logs

Open Insights › Log Explorer and filter by dataset: syslog for the Syslog integration, or the vendor integration's name, such as cisco_ios. SNMP traps from the same devices are in the snmp.traps dataset; see SNMP polling and traps.

Next steps