This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Checking if the Logs are being send to Syslog Server

I'am trying to send logs to an external Syslog server via Remote Syslog Settings but i don't have any access to the server how am i gonna check if the logs are actually being sent?

This thread was automatically locked due to age.

Top Replies

dirkkotte over 2 years ago +1

you may use tcpdump: tcpdump -nei any port 514

Parents

0 dirkkotte over 2 years ago

you may use tcpdump:

tcpdump -nei any port 514

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up +1 Vote Down

Cancel
0 Bulutistan-Network over 2 years ago in reply to dirkkotte

Thanks for the reply, here is the ss from the command. the blank part is my public IP. Do you see any kind of problem cuz as much as i see Logs are going.
Cancel
Vote Up 0 Vote Down

Cancel
0 dirkkotte over 2 years ago in reply to Bulutistan-Network

Looks ok for me ... if 172.16.1.8 is your "external" Syslog-server.

you may try tcpdump -nei any | grep 172.16.1.8

to see if there are answer-packets too ...

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up +1 Vote Down

Cancel

Reply

0 dirkkotte over 2 years ago in reply to Bulutistan-Network

Looks ok for me ... if 172.16.1.8 is your "external" Syslog-server.

you may try tcpdump -nei any | grep 172.16.1.8

to see if there are answer-packets too ...

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up +1 Vote Down

Cancel

Children

0 Bulutistan-Network over 2 years ago in reply to dirkkotte

Thanks now i can check the in/out packets from 514 or any port.
Cancel
Vote Up 0 Vote Down

Cancel
0 dirkkotte over 2 years ago in reply to Bulutistan-Network

here is no port limitation ... but you can cascade multiple grep ...

tcpdump -nei any | grep 172.16.1.8 | grep 514

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up 0 Vote Down

Cancel