Skybox version 11.7.100
28
Chapter 5
Customizing the syslog server
The syslog server in Skybox Appliance is preconfigured and is enabled by default.
In this chapter
Setting up TCP and UDP listeners
Setting up TCP and UDP listeners
Skybox Appliance includes TCP and UDP listeners for the syslog server.
To set up TCP and UDP listeners
1. On the System tab, click Syslog Server.
2. Select the listeners and adjust their bind addresses and ports as necessary.
The listeners are disabled by default; the default port for each is 514. You can enable either
or both listeners, and you can change the bind address and port as necessary.
3. Click Apply Syslog Configuration.
Working with syslog files
Updates to the configuration files of the syslog server and to the syslog log rotation file are
included (when necessary) as part of Skybox Appliance operating system updates.
Users can also modify the following files locally for local changes:
l
syslog configuration file:
/etc/syslog-ng/syslog-ng.conf
l
cron file:
/etc/cron.daily/syslog-ng-archive
How can I change where and for how long the logs are stored?
You can change the following parameters (shown here with their default values) in the cron
file:
l
LOGGER_TAG="skybox-syslog-ng-archive"
l
TRAFFIC_LOGS_NEW="/var/log/syslog-ng/new"
(directory for new files)
l
TRAFFIC_LOGS_OLD="/var/log/syslog-ng/old"
(archive directory)
l
CHANGE_LOGS_NEW="/var/log/firewall_assurance/change_logs"
(directory for new
files)
l
CHANGE_LOGS_OLD="/var/log/firewall_assurance/change_logs_old"
(archive
directory)
l
LOG_RETENTION=2
(days to keep logs)
l
ARCHIVE_RETENTION=3
(days to keep archives after they are saved in the archive directory)
