Switching

Hello,

Is it possible to syslog from an EX switch to a remote syslog server over a TCP connection? I couldn't find the commands to setting up that. This is what my current config is:

user@EX9200> show configuration system syslog host 10.10.x.x
any info;

user@EX9200>

This send syslog over UDP 514

You can only syslog via udp on the EX platform.

There are more possibilities on the SRX platforms where security logs can be send via tcp or tls (set security log transport protocol udp|tcp|tls). Non-security logs will (to my knowledge) still be ordinary udp/514 from the device.

Oops...that's terrible.

I have this config running in a SRX345, but still the security logs are not in the monitoring tool(Splunk). I have verified that the Splunk has a listener configured on TCP 9514.

user@SRX345> show configuration security log
cache;
mode event;
report;
source-address 10.10.x.1;
transport {
    protocol tcp;
}
stream LOGS {
    host {
        10.10.x.x;
        port 9514;
    }
}

{primary:node0}

Can you please tell me if these configs are good?

I did a bit of testing and the tcp sessions only shows up when you have security logging in stream mode. So try changing this and revert with the result.