MonitorWare Knowledge Base

Hello,

I'm trying to configure the Monitorware Agent Syslog service (on server1) to forward our Netscreen firewall messages to another syslog server (server2 - not Adiscon syslog - it is a syslog service that comes with a product called 'Firewall Analyzer v3.2'). When I use the Interactive Syslog Client on server2 I can see the the forwarded messages arriving. I then close the Interactive Syslog Client, and make sure that nothing else is listening on UDP port 514. After this I start the Firewall Analyzer syslog and I get nothing.

Just to test things, I configured the Netscreen firewall to send its syslog messages directly to the 'Firewall Analyzer' syslog and it worked fine.

Why aren't the forwarded messages picked up by the 'Firewall Analyzer' syslog? One would assume that they would still be in the standard syslog format?

Thanks for your help,

Krishna.

There is an option "include original source when forwarding" in the send syslog action. If checked, this will make the message non-standard as it includes an additional string. Please make sure this is unchecked. Then it should work.

Best regards,
Rainer Gerhards
Adiscon