Enabling Syslog Rfc 5424 Compliance With Hostname - D-Link NetDefendOS User Manual

Note: The Syslog server itself must be correctly configured
The external Syslog server itself may have to be configured to correctly receive log
messages from NetDefendOS. Refer to the documentation for the specific Syslog server
being used in order to do this.
RFC 5424 Compliance
By default, NetDefendOS sends Syslog messages in a format that is suitable for most Syslog
servers. However, some servers may require stricter adherence to the latest Syslog standard as
defined by RFC 5424. For this reason, NetDefendOS provides the option to enable strict RFC 5424
compliance.
Setting the Hostname
In the header of every Syslog message there is a string field which is the Syslog hostname. By
default, NetDefendOS always sets this to be the IP address of the sending interface.
If RFC 5424 compliance is enabled, it is also possible to set the hostname to a specific value. The
example below shows how this is done.
Example 2.29. Enabling Syslog RFC 5424 Compliance with Hostname
This example enables logging of all events with a severity greater equal to Emergency or Alert to a
Syslog server with the IPv4 address 192.168.5.1. RFC 5424 compliance will also be enabled with a
hostname of my_host1 in the Syslog header.
Command-Line Interface
gw-world:/> add LogReceiver LogReceiverSyslog my_syslog
Web Interface
1. Go to: System > Device > Log and Event Receivers > Add > Syslog Receiver
2. Specify a name for the event receiver, in this example my_syslog_host
3. Enter 192.168.5.1 as the IP Address
4. Select an appropriate facility from the Facility list.
5. Enable the option RFC 5424 Compliance.
6. Enter my_host1 for the Hostname
7. Select SeverityFilter and choose Emergency and Alert as the severities.
8. Click OK
Chapter 2: Management and Maintenance
IPAddress=192.168.5.1
RFC5424=Yes
Hostname=my_host1
LogSeverity=Emergency,Alert
91