Configuring the NSM to Send Syslogs

Syslog traffic must be configured to arrive to SecureTrack from the IP and/or host name of the device.

Syslog proxy is supported for specific devices. For more information on syslog proxy support for supported devices, see Configuring Devices to Send Logs.

Only rules that are marked for logging in the device are included in the syslogs.

Define SecureTrack as a syslog server on the NSM

1. Make sure that the IP address of each Juniper NetScreen device is configured identically on both SecureTrack and on the NSM.

   For JunOS devices, you must configure each device to send syslogs directly to SecureTrack.

2. Log into the NSM.

3. In the navigation pane, under Action Manager, select Action Parameters:

   

4. In the Action Parameters pane, double-click the entry row:

   

5. In the Action Parameters window, enter the following:

   

   • Syslog Server IP: The syslog VIP address of the cluster that is managing the device

   • Syslog Server Facility: Select local use 7 (local7)

     If you need to use a different facility, you can, in which case you'll also need to configure SecureTrack as described in this tech note.

   Click OK.

6. In the navigation pane, under Action Manager, select Device Log Action Criteria:

   

7. To enable identification of users who made policy changes and the time of those policy changes, do the following:

   1. Click the plus sign:

      

   2. By Category, select Config (predefined):

      

      No Subcategory should be selected.

   3. In the Actions tab, select Syslog Enable:

      

   4. Click OK.

8. To enable Usage reporting, do the following:

   1. Click the plus sign:

      

   2. By Category, select Traffic (predefined):

      

   3. For Subcategory, select Traffic Log:

      

   4. In the Actions tab, select Syslog Enable:

      

   5. Click OK.