Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Forwarding Syslog events ?

I'm pretty sure I got it right just wanted some reassurance from the people at Thwack. I used the SAM syslog viewer to set up an alert to forward all syslog events to our Q-Radar.

The only thing I did was create a new forward rule then under "Alerts/Filter Rules" tab put the IP address of Q-Radar and left the other tabs at their default values ("*") .

My goal is to forward all the syslog messages received by Solarwinds to our Q-Radar appliance. I still want the syslog data to be available to Solarwinds for web console.

Find more posts tagged with

Accepted answers

All comments

mharvey

Greg,

The only place the Q-Radar IP should need to be is in the Forward Syslog Action. The entire rule should be set with * to basically say that all syslogs from all IPs regardless of message type or message pattern, and all severities be forward to Q-Radar. If you put the IP of the Q-Radar in anything in the rule, such as Source IP Address, then the only syslogs it would forward are those from the Q-Radar server being sent into your SAM server.

Regards,

Matthew Harvey

Loop1 Systems

gregatkins

Great!

That means I set up correctly. Thanks for your feedback

FormerMember

PrtScr capture_11.jpg I have a samiller issuse , i have set up a rule ,
When i test it i get a massge sent to the qradar, though when i actully get logs from the log forwarder to the kiwi syslog , i dont receive them on the qradar .

need help

mharvey

Can you repost the picture as an attachment, it's hard to make out and very blurry.

aLTeReGo

, I recommend re-posting this question in the forum.