Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Forward syslog message from Orion to addtional syslog data base for compliance

Hi We are using Orion NPM which is picks up logs directly from our firewalls. I need now collect our firewall logs into a Loglogic syslog device for compliance purposes

Is possible forward out of Orion NPM to our Log Logic device and if so how do i achieve that. we are not in position to add in an additional logging host in to the firewall config as they are running at max at the moment.

Find more posts tagged with

Accepted answers

bshopp

If you open the Syslog Viewer Win32 UI on the Orion server and create a new rule, when creating that new rule select the action "Forward Syslog" and you will see the below dialog where you can say to retain the original source IP as well as other settings including spoofing.

All comments

seigniory

Set up a Solarwinds Kiwi Syslog server on the same subnet as the Orion server.
Point your syslogs at the Kiwi server, not the Orion server.
Set up a rule in Kiwi to forward the original syslog message to Orion keeping the source IP intact, and another rule to forward the syslog message to the compliance system.

Works like a charm.

bshopp

This method would work just fine, obviously he would need to purchase Kiwi Syslog. Orion NPM does also have the ability to do this as well. You can setup a Syslog Rule in the Syslog Viewer to forward all or specific messages to your other system. When creating the rule, on the actions tab select forward as Syslog as the action and set the appropriate settings.

seigniory

Correct, but correct me if I'm wrong, Orion doesn't (yet) have the "spoof" ability that Kiwi has - so all the syslogs would appear to be coming from the Orion server, and not the original one.

For a compliance solution, I figured that it's worth a little extra money to "preserve" the syslog UDP headers, but that's that's just my $0.02. :-)

bshopp

Not sure what version you are on, but we added that feature in 10.0. Actually the Kiwi guys themselves added it