Configuring SecureTrack for Non-Default Syslogs

Overview

For some types of monitored devices, you must configure the device to send syslogs (Configuring Devices to Send Logs) to SecureTrack in order to get accountability and usage data. SecureTrack is preconfigured to receive syslogs for facility local7, and for the default severity levels of syslogs sent by each firewall vendor (listed below). To use a non-default facility or severity level, you must manually configure SecureTrack for each device type that sends non-default syslogs. For these device types, your manual settings override the default settings in SecureTrack.

If a firewall is monitored as a standalone device and as the child of a management device, you must disable either the standalone or the management in order to collect syslogs.

Configure SecureTrack

Use the following procedure to configure SecureTrack to receive syslogs with non-default facilities and/or severity levels for a specific device type.

1. Find the parser ID string for the device type sending the syslogs. Parser ID strings are:

   Device type	Usage syslogs	Accountability syslogs
   Cisco FMCs	CiscoFmc	CiscoFmc
   Cisco Firewalls	CiscoDevice	CiscoDevice
   Cisco Routers	CiscoRouter	CiscoRouter
   Fortinet FortiManager 5.24 or lower	Fortinet	FortiManager
   Fortinet FortiManager 5.4 or higher	Fortinet	FortiManagerAsAPlatform
   Fortinet FortiGate	Fortinet	Fortinet
   Juniper JunOS	JunOs	JunOs
   Juniper Netscreen	Netscreen	Netscreen
   Juniper NSM	NSM	NSM
   Palo Alto Panorama 7.0 or lower	PaloAlto	PaloAlto
   Palo Alto Panorama 7.1 or higher	PaloAlto	PanoramaNg
   Palo Alto Firewalls	PaloAlto	PaloAlto
   VMware NSX	Nsx	Nsx

2. Find the code numbers for the facilities that you want in the syslogs. Facility codes are:

   kernel messages	0
   user-level messages	1
   mail system	2
   system daemons	3
   security/authorization messages	4
   messages generated internally by syslogd	5
   line printer subsystem	6
   network news subsystem	7
   UUCP subsystem	8
   clock daemon	9
   security/authorization messages	10
   FTP daemon	11
   NTP subsystem	12
   log audit	13
   log alert	14
   clock daemon	15
   local use 0 (local0)	16
   local use 1 (local1)	17
   local use 2 (local2)	18
   local use 3 (local3)	19
   local use 4 (local4)	20
   local use 5 (local5)	21
   local use 6 (local6)	22
   (Default:) local use 7 (local7)	23

3. Find the severity levels sent by your devices. The default severity levels are:

   Cisco	5
   Fortinet	3,4,5,6,7
   JunOS	5,6
   Netscreen	4,5,6
   NSM	1
   Palo Alto	6
   VMware NSX	13, 14

4. Calculate your relevant priority codes - one priority code for each possible combination of facility code with severity level.

   The priority code is defined as the facility code multiplied by 8, plus the severity level code:

   Priority code = 8 * Facility code + Severity level code

   For example, if your JunOS devices use the default severity levels, but may produce syslogs with facility codes 1, 22, or 23, then you may need to calculate six priority codes (for severity code 5 with each of these three facility codes, and for severity code 6 with each of the three facility codes). However, if you know that facility code 1 will only occur with severity code 6, and the other two facility codes (22,23) only with severity code 5, then you only need to calculate three priority codes. These will be 14,181, and 189:

   8*1+6=14

   8*22+5=181

   8*23+5=189

   Make a note of the calculated priority codes.

5. Open your browser and log into SecureTrack as a SecureTrack Administrator.

6. In the browser, enter this URL:

   https://<SecureTrack_IP>/stcgitest.htm

7. Click Edit StConf

8. Click Fetch Current Conf

9. Under <conf>, add the following lines, substituting the relevant parser ID string (from step 1) for parserid (keep the quote marks):

   <Override_Syslog_Priority message_parser_type="parserid">
   </Override_Syslog_Priority>
   

   Supported values for parserid are:

   • CiscoFmc

   • CiscoDevice (includes ASA firewalls)

   • CiscoRouter, JunOs

   • Fortinet

   • JunOs

   • Netscreen

   • PaloAlto

   • PanoramaNg

   • FortiManager

   • NSM

   • Nsx

   • FortiManagerAsAPlatform

10. Between the above two lines, for each required priority code (from step 4), add a line in the following form, substituting the relevant priority code for pc:

    <pri>pc</pri>

    Using the example from above (step 4), you would now have:

    <Override_Syslog_Priority message_parser_type="JunOs">
    <pri>14</pri>
    <pri>181</pri>
    <pri>189</pri>
    </Override_Syslog_Priority>

11. At the bottom of the page, click Submit New Conf

12. Restart all syslogs:

    kubectl get pods -n default --no-headers=true | awk '/syslog-agent/{print $1}'| xargs  kubectl delete -n default pod

    The deleted pods will restart automatically.