rsyslog redirect

This procedure sends successful and failed login attempts to the TMG unit sent to an external syslog server using rsyslog.

Notes

The default UDP port for the syslog server is 514. Change the hostname of the syslog server accordingly. In the procedure below, the hostname if the syslog server is : lab_syslog_server .
This procedure works for a standalone system.

Procedure For Syslog redirect

Connect to SSH interface: Connect to SSH

Add information to send to remote syslog

For successful/failed login, messages and cron info, do this command:

echo -e "\n#Send to remote syslog\nauthpriv.*;*.info;cron.*                                @lab_syslog_server\n" >> /etc/rsyslog.conf

Then restart the rsyslog service:

systemctl restart rsyslog

If server hostname (lab_syslog_server) is unreachable, edit the hosts file:

cat /etc/hosts

And add this line to the file:

 [IP of syslog server] lab_syslog_server
 e.g. 192.168.77.88 lab_syslog_server

Test the process

Tail the file on the syslog server and access the unit with SSH:

tail -f /var/log/secure

you will see something like this:

Jan  4 15:42:11 192.168.101.170 HOSTOSIRIS sshd[3867]: Accepted password for root from 204.23.12.53 port 26149 ssh2

Default log files

By default, access information will be sent to this file on the syslog server:

tail -f /var/log/secure

and system messages will be sent to this file:

tail -f /var/log/messages