Jump to content


Photo

Syslog output does not include configuration changes

prtg syslog email

  • Please log in to reply
3 replies to this topic

#1 timcin

timcin
  • Members
  • 2 posts

Posted 09 May 2016 - 11:12 AM

I am running a Barracuda Email Security Gateway 400 and am trying to use PRTG Syslog Receiver to capture login and configuration changes. In the PRTG screen I see the Login happen and it shows up in the PRTG message window. Now if I go and make a change in Block/Accept, Attachment filters, and add an attachment type, that change does not appear in the syslog output to PRTG's message window. If I logout, that will show up in PRTG.

 

Now if I go to Advanced, Troubleshooting, and select Web Syslog, I can see any configuration changes.

I spoke with an engineer at Barracuda and he said this data should be going out the syslog port 514. However, it doesn't show up in the message window on PRTG. I would like to get this setup so that if a change occurs I can have PRTG send me an email with the change.

 

Anyone have any ideas why the data isn't showing up?

 

Timcin



#2 mheller

mheller

    Nobody

  • Moderators
  • 1,299 posts
  • LocationSan Jose, CA

Posted 09 May 2016 - 11:42 AM

Hi Tim,

 

This should be easy to debug, for starters I would perform a tcpdump to ensure the changes being made to attachment filters etc.. does generate a syslog message.

 

After this, if we confirm it is being sent to your PRTG instance, this would mean something wrong in the PRTG side

 

We'd recommend you re contact support, or let m know the case number and we will follow up!



Matthew Willson-Heller
Support Escalation Manager, US

Barracuda Networks Inc.
Phone: +1 408.342.5300 x5346
Fax: +1 408.342.1061
Web: www.barracudanetworks.com



#3 timcin

timcin
  • Members
  • 2 posts

Posted 10 May 2016 - 08:36 AM

Matthew,

 

I just ran a tcpdump and while it was running I went into Attachment Filename Filters and added *.zzz. I stopped the tcpdump, copied all of the data and dropped it into Notepad and searched for *.zzz and the configuration change was not there.

 

Tim



#4 mheller

mheller

    Nobody

  • Moderators
  • 1,299 posts
  • LocationSan Jose, CA

Posted 10 May 2016 - 10:54 AM

Please contact support and we will double check all other aspects and file a bug if needed !



Matthew Willson-Heller
Support Escalation Manager, US

Barracuda Networks Inc.
Phone: +1 408.342.5300 x5346
Fax: +1 408.342.1061
Web: www.barracudanetworks.com