ITA 9.3.x or later syslog support

[tjlaw]

Dear Community, 

Is syslog export supported in ITA 9.3.x or later version? 

Thank you. 

BR, 

TJ

[gsterling · Accepted solution]

Hello TJ, customers may setup rsyslog export from ITA servers.

Schneider installs a file in /etc/rsyslog.d named “operation-logs.conf”. On some older ITA releases customers must first edit this file and comment a few statements to allow rsyslog forwarding to work. The below edits are not necessary in the 9.4.x versions of ITA and newer. 

• You will need to edit the operation-logs.conf file, and comment the three lines containing the word “stop” by placing a “#” character on those lines before the word “stop”.
• Save the changes.

To forward syslog entries on your ITA server to an external source.

Edit /etc/rsyslog.conf.

Add the forwarding directive in this format. You should be able to place this line at the bottom of the rsyslog.conf file.

*.* @@<remote-server>:<remote-port>

The above line will cause all messages written to syslog to be forwarded to "<remote-server>" on port "<remote-port>"

Then restart the rsyslog service

systemctl restart rsyslog

Regards

Greg Sterling

[Jef · Accepted solution]

Hi TJ,

In latest version(s) of ITA, there seem to be included some option/settings for remote logging.
You might want to edit the config file: /etc/rsyslog.conf 

and look for the following lines (at the end of the file):

# Remote Logging (we use TCP for reliable delivery)
# remote_host is: name/ip, e.g. 192.168.0.1, port optional e.g. 10514
#Target="remote_host" Port="XXX" Protocol="tcp"

(remove this # , when doing your configuration), 

Then restart the rsyslog service

systemctl restart rsyslog

Kind regards,

Jef

[Dayanand]

Hi All,

We are using ITA 9.5.1. I have edited the line in rsyslog.conf as Target="remote_host" Port="XXX" Protocol="udp".

I am trying to use UDP instead of TCP.  I have removed # sign at the beginning of line and also removed inverted commas enclosing target host, port and protocol.

Restarted the service using -> systemctl restart rsyslog

Still no logs are reported on our SIEM server. 

Let me know if I am missing something. Do we also need to edit below lines as well and remove # sign to enable UDP reporting.

# Provides UDP syslog reception

# for parameters see http://www.rsyslog.com/doc/imudp.html

#module(load="imudp") # needs to be done just once

#input(type="imudp" port="514")

Regards,

Dayanand