Syslog Fowarding from Barracuda

[Mike Riforgiate]

Barracuda Configuration

This option is available under Advanced -> Export Logs -> Syslog.

The following are the fields to configure a syslog server:

• Name – Enter the name of the syslog server.
• Syslog Server – Enter the IP address of the syslog server.
• Log Time Stamp – Select “Yes” to log date and time of the system events.
• Log Unit Name – Select “Yes” to log the name of the Barracuda Web Application Firewall unit. The unit name is same as the Default Host name on the BASIC > IP Configuration page.
• Comment – Enter comments about the syslog server.

Syslog Settings:

The system, web firewall, access and audit logs are logged at different facilities to help manage them well on the external syslog server that they get transferred to. You can set the facilities local0 to local7 for these log types. To do this, click Syslog Settings and select the appropriate option.

You can also set the same facility for all the log types. For example, you can set local0 for system logs, web firewall logs, access logs and audit logs.

• System Logs – local0 to local7
• Web Firewall Logs – local0 to local 7
• Access Logs – local0 to local 7
• Audit Logs – local0 to local 7

Different priority levels are applicable to Web Firewall Logs depending on the severity of the Web Firewall action. All Access Logs and Audit Logs are logged at priority INFO.

Module Log Levels:

In this section you can set the log levels for a module, based on which the logs are sent to the syslog server. For example, if you select the “Module” as “Rewrite” and “Log Level” as “3-Error”, then logs with 0-3 log levels are sent to the syslog server.

• Name – Enter a name for the new setting.
• Module – Select a module name from the drop-down list.
• Log Level – Select a log level from the drop-down list.
• Comment – Enter comment about the new setting.

 

Barracuda Configuration doc

[Author]

Posts