[SOLVED] Windows -> syslog -> syslog

andrewhiggs · 06-27-2014, 09:32 AM

Hi all,

I have a Slackware router / firewall in each of our stores. These do remote logging to a Slackware server here at HO. I have windows machines in the stores which I have logging to the syslog on the router / firewall.

What I would like is for all the windows events arriving at the firewall syslog to also go through to the remote syslog at HO. Can this be done?

I thought getting the windows logging through to the firewall would automatically make it log to the remote server too.

Any assistance would be greatly appreciated. Thanks

Regards

TB0ne · 06-27-2014, 11:59 AM

Quote:

Originally Posted by andrewhiggs

Hi all,
I have a Slackware router / firewall in each of our stores. These do remote logging to a Slackware server here at HO. I have windows machines in the stores which I have logging to the syslog on the router / firewall.

What I would like is for all the windows events arriving at the firewall syslog to also go through to the remote syslog at HO. Can this be done?

I thought getting the windows logging through to the firewall would automatically make it log to the remote server too.

Windows systems (by default), don't send anything to *nix syslog servers. You would have to load and configure some sort of syslog daemon on the Windows system, such as:
http://edoceo.com/creo/winlogd

If you are seeing Windows events on the Slack systems now, then you may just have to configure what's getting sent to the 'mirror' syslog server, so those events are passed along. They may look different than what's getting logged now.

Richard Cranium · 06-27-2014, 01:26 PM

From "man syslogd"...

Code:

       With  normal  syslogds  you would get syslog-loops if you send out mes-
       sages that were received from a remote host to the same host  (or  more
       complicated to a third host that sends it back to the first one, and so
       on).  In my domain (Infodrom Oldenburg) we accidently got one  and  our
       disks filled up with the same single message. :-(

       To  avoid  this no messages received from a remote host are sent out to
       another (or the same) remote host anymore.  If you experience are setup
       in  which  you  need  this  behaviour,  please  use the -h command line
       switch.  However, this option needs to be handled with caution since  a
       syslog loop can fill up hard disks quite fast.

Bolding added. I haven't checked to see if the man page is lying.

Habitual · 06-27-2014, 06:52 PM

Collecting and forwarding logs from Windows
Syslog Agent
nxlog
syslog-ng

for starters.

andrewhiggs · 06-30-2014, 04:08 AM

Hi TBOne, Richard and Habitual

Thanks all for the replies. I already had the windows machine logging to the first syslog server so the software on windows was already working.

Richard, your hit worked. I feel a bit embarrassed that the answer to my question was actually in the man page. But thank you very much for pointing it out so politely. :-) It worked so all is sorted now. You are a star.

Regards

TB0ne · 06-30-2014, 09:04 AM

Quote:

Originally Posted by andrewhiggs

Hi TBOne, Richard and Habitual

Thanks all for the replies. I already had the windows machine logging to the first syslog server so the software on windows was already working.

Richard, your hit worked. I feel a bit embarrassed that the answer to my question was actually in the man page. But thank you very much for pointing it out so politely. :-) It worked so all is sorted now. You are a star.

Thanks for posting back with the solution, and letting folks know what worked for you.