Raw Syslog Forwarder¶

Adding a Target¶

You can send logs to the same target via different ports too. To do so, you can add the same target IP multiple times, each time with a different port number.

1. Go to Settings >> Configuration from the navigation bar and click Raw Syslog Forwarder.

Raw Syslog Forwarders¶

2. Click Targets.

Remote Targets¶

3. Click Add IP.

Add a Remote Target¶

4. Enter the Name, IP address, and Port number for the input port of the target.

5. Select the Protocol to send the syslog message.

   Note

   Choosing UDP enables IP Spoofing. IP Spoofing allows you to directly add the log collection devices in the target logpoint instead of adding them in the raw syslog forwarder, and the target logpoint still identifies the raw syslog forwarder where the logs are collected.

6. Click Submit.

Editing a Target¶

1. Go to Settings >> Configuration from the navigation bar and click Raw Syslog Forwarder.

2. Click Targets.

3. Click the Name of the required target.

Remote Targets¶

4. Update the information.

5. Click Submit.

Deleting a Target¶

To delete a target, make sure that it is not in use.

1. Go to Settings >> Configuration from the navigation bar and click Raw Syslog Forwarder.

2. Click Targets.

3. Click Delete.

Remote Targets¶

4. Click Yes.

Adding Devices¶

1. Go to Settings >> Configuration from the navigation bar and click Raw Syslog Forwarder.

Devices¶

2. Click Add.

Configure Devices¶

3. Double-click the devices or device groups to select them.

   Note

   If you select All for a device group, any device added to it in the future is automatically selected as a target.

4. Select the Remote Target(s).

5. Provide a regex Pattern to match before forwarding logs. Only the logs matching the specified pattern are forwarded. For example:

   • [ 0-9 ]+ forwards a log only if a digit is present in logs.

   • [ a-z A-Z 0-9 ]+ forwards a log only if it contains either a-z, A-Z, or 0-9.

   • \S+ forwards all the logs.

6. Click Submit.

After the configuration, Raw Syslog Forwarder now collects logs from the added devices and forwards the raw logs to the chosen targets.

Editing Devices¶

1. Go to Settings >> Configuration from the navigation bar and click Raw Syslog Forwarder.

2. Click the Device of the required Raw Syslog Forwarder.

Devices¶

3. Update the information.

4. Click Submit.

Deleting Devices¶

1. Go to Settings >> Configuration from the navigation bar and click Raw Syslog Forwarder.

2. Click Delete.

   

   Raw Syslog Forwarders¶

   1. To delete multiple Raw Syslog Forwarders, select the concerned forwarders, click More and select Delete Selected.

   

   Raw Syslog Forwarders¶

   2. To delete all the forwarders, click More and select Delete All.

   

   Raw Syslog Forwarders¶

3. Click Yes.

Logs Forwarded From Localhost¶

To view logs from localhost, you must add the IP of the Raw Syslog Forwarder in the remote target. You must also configure its Syslog Collector.

While forwarding localhost logs, Logpoint adds additional data in the header and sends the original message in the following format:

<13> {local date time} {hostname} {original message}

Example:

Logs Forwarded from a Device¶

You have to add a device in target logpoint and configure its syslog collector to view the logs forwarded from that device.