Skybox version 10.1.200
29
Chapter 6
The syslog server in Skybox Appliance is preconfigured and is enabled by default.
In this chapter
Setting up TCP and UDP listeners
.......................................... 29
............................................... 29
Setting up TCP and UDP listeners
Skybox Appliance includes TCP and UDP listeners for the syslog server.
To set up TCP and UDP listeners
1
On the System tab, click Syslog Server.
2
Select the desired listeners and adjust their bind addresses and ports as
necessary.
The listeners are disabled by default; the default port for each is 514. You can
enable either or both listeners, and you can change the bind address and port
as necessary.
3
Click Apply Syslog Configuration.
How to work with syslog files
Updates to the configuration files of the syslog server and to the syslog log
rotation file are included (when necessary) as part of Skybox updates.
Users can also modify the following files locally for local changes:
›
syslog configuration file:
/etc/syslog-ng/syslog-ng.conf
›
cron file:
/etc/cron.daily/syslog-ng-archive
How can I change where and for how long the logs are stored?
The following parameters (shown here with their default values) can be changed
in the cron file:
›
LOGGER_TAG="skybox-syslog-ng-archive"
›
TRAFFIC_LOGS_NEW="/var/log/syslog-ng/new"
(directory for new files)
›
TRAFFIC_LOGS_OLD="/var/log/syslog-ng/old"
(archive directory)
›
CHANGE_LOGS_NEW="/var/log/firewall_assurance/change_logs"
(directory for new files)
Customizing the syslog server
