How to confirm firewall syslogs are getting to Analyzer

03/26/2020 1,167 People found this article helpful 200,074 Views

Description

This article explains how to check the Syslog forwarded by SonicWall reaches Analyzer server or not. In some cases User will not see data in Analyzer because of no syslog forwarded to it. First thing we need to check is port open in server and Analyzer syslog reader.

Resolution

Step 1: Check Port open in Server where Analyzer is installed
Step 2: Enable Syslog Forwarder in Analyzer

Step 1: Check Port open in Server where Analyzer is installed
Login to Server in which Analyzer is installed.

1) Open Command Prompt in that server and t ype netstat -an command to find ports used by server. 2) If UDP 514 is shown in that as below, then it is opened and listening for syslog. If it is not show, check your server settings to allow it.

Step 2: Enable Syslog Forwarder in Analyzer

Login to Analyzer in Application interface with URL as "http://127.0.0.1/sgms/auth"

1) Select Firewall tab. Click Global View on left side and go to Real-Time Viewer -> Syslog

2) Click Settings to get Settings Manager Window as below

3) Select Enable Syslog Forwarding checkbox. It will show Settings Manager- Message window as below with note

"Syslog Viewer uses syslogs forwarded from the Syslog Collector for viewing.

Note: Enabling this option will forward syslogs received by all Syslog Collector services in a deployment to the Web Server. This will increase the syslog traffic across the network, since every message is cloned by the Syslog Collector for event handling."

4) Click OK button in Settings Manager- Message Window.

5) Click Update button in Settings Manager Window,

6) Click Start button in Control to see Syslogs forwarded to server as below

7) Syslog from SonicWall will be forwarded as below

8) Also you can see the information about it in log as below. It will be shown in Console tab, Log -> View Log.