rsyslog redirect

This procedure sends successful and failed login attempts to the TMG unit sent to an external syslog server using rsyslog.

Notes

The default UDP port for the syslog server is 514 and this procedure redirects it to port 1524.
Change the hostname of the syslog server accordingly. In the procedure below, the hostname if the syslog server is : lab_syslog_server .
This procedure works for a standalone system.

Procedure For Syslog redirect

Make sure mgmt0 is available and active

Connect to SSH interface: Connect to SSH

Firewall rules to the management port

iptables -t nat -A OUTPUT -p udp --dport 514 -j DNAT --to-destination :1524 service iptables save service iptables restart

Verify firewall rules

iptables -L -v; iptables -t nat -L -n -v

Add information to send to remote syslog

For successful/failed login, messages and cron info, do this command:

echo -e "\n#Send to remote syslog\nauthpriv.*;*.info;cron.*                                @lab_syslog_server\n" >> /etc/rsyslog.conf

Then restart the rsyslog service:

systemctl restart rsyslog

If server hostname (lab_syslog_server) is unreachable, edit the hosts file:

cat /etc/hosts

And add this line to the file:

 [IP of syslog server] lab_syslog_server
 e.g. 192.168.77.88 lab_syslog_server

Test the process

Tail the file on the syslog server and access the unit with SSH:

tail -f /var/log/secure

you will see something like this:

Jan  4 15:42:11 192.168.101.170 HOSTOSIRIS sshd[3867]: Accepted password for root from 204.23.12.53 port 26149 ssh2

Default syslog port

If the remote syslog server is on the default port 514, remove this line from the iptables:

iptables -t nat -A OUTPUT -p udp --dport 514 -j DNAT --to-destination :1524

To delete iptables rules:

iptables -t nat -D OUTPUT 1
service iptables save
service iptables restart

Default log files

By default, access information will be sent to this file on the syslog server:

tail -f /var/log/secure

and system messages will be sent to this file:

tail -f /var/log/messages