ags log-forwarders

The ags log-forwarders command manages the profiles that define the transfer of the audit records produced by the access gateway to a syslog server. Its panel equivalent is the Log Forwarding screen.

The profile is bound to the gateway with the --auditLogForwarders.0 field. This is a list field: a gateway can transfer its records to more than one target.

Command Summary

TR7 WEB-CLI · ags log-forwarders

admin@TR7LBWAF01> ags log-forwarders list # list all of them

admin@TR7LBWAF01> ags log-forwarders show <id> # show one

admin@TR7LBWAF01> ags log-forwarders add name <name> syslogHost <address> …

admin@TR7LBWAF01> ags log-forwarders update id <id> … # change

admin@TR7LBWAF01> ags log-forwarders delete <id> # delete

admin@TR7LBWAF01>  

Required Fields

Order	Field	Status	Value
1	name	Required	The name of the profile
2	syslogHost	Required	The address of the syslog server to which the records will be sent

The Transfer Settings

Field	Default	Value
--syslogPort	514	The port of the server
--syslogProtocol	udp	udp or tcp
--syslogFormat	rfc3164	The syslog format: rfc3164 or rfc5424
--syslogMessageFormat	json	The format of the message body: json or cef
--syslogAppName	TR7_AGS	The application name that will appear in the records
--namespace	The default route table of the device	The route table from which the records will go out

Examples

TR7 WEB-CLI · A) A transfer with the default settings

admin@TR7LBWAF01> ags log-forwarders add name central-syslog syslogHost 10.0.0.60

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) A transfer to the SIEM with the TCP and CEF format

admin@TR7LBWAF01> ags log-forwarders add name siem-transfer syslogHost siem.institution.local \

--syslogPort 6514 --syslogProtocol tcp --syslogFormat rfc5424 \

--syslogMessageFormat cef --syslogAppName TR7_ACCESS

admin@TR7LBWAF01>  

TR7 WEB-CLI · C) Binding the profile to the gateway

admin@TR7LBWAF01> ags log-forwarders list # find the identifier of the profile

admin@TR7LBWAF01> ags gateway update id <vService> --auditLogForwarders.0 <profile>

admin@TR7LBWAF01>  

Updating and Deleting

TR7 WEB-CLI · update and delete

admin@TR7LBWAF01> ags log-forwarders update id <kimlik> --syslogProtocol tcp --syslogPort 601

admin@TR7LBWAF01> ags log-forwarders delete <kimlik>

admin@TR7LBWAF01>  

Things to Know

• The profile must be bound to the gateway. The binding field is a list: more than one target can be defined with --auditLogForwarders.0, --auditLogForwarders.1.
• The route table is important. If the syslog server will be gone out to from another route table, --namespace must be written.
• UDP is the default. If a transfer without loss is needed, the protocol is changed to tcp.
• The message format is selected according to the target. Most of the SIEM products expect cef; the json format carries more detailed fields.