Logging using syslog

You can send the Event log to one or more syslog servers on the network for storage or analysis.

To configure the syslog facility, go to Logs > Syslog.

On this page:

Syslog settings
Using syslog

Syslog settings

Refer to this table for assistance when configuring Syslog settings:

Field	Field description	Usage tips
Host address 1 to 4	Enter the IP addresses of up to four Syslog receiver hosts.	The number of packets sent to each configured host is displayed next to its IP address.
Facility value	A configurable value for the purposes Choose from the following options: 0 - 1 - 2 3 4 - 5 - 6 - 7 - 8 - 9 - 10 - 11 - 12 - 13 - 14 - 15 - 16 - 17 18 - 19 - 20 - 22 23 of identifying events from the IP VCR on the Syslog host. kernel messages user-level messages - mail system - system daemons security/authorization messages (see Note 1) messages generated internally by syslogd line printer subsystem network news subsystem UUCP subsystem clock daemon (see Note 2) security/authorization messages (see Note 1) FTP daemon NTP subsystem log audit (see Note 1) log alert (see Note 1) clock daemon (see Note 2) local use 0 (local0) - local use 1 (local1) local use 2 (local2) local use 3 (local3) local use 4 (local4) 21 - local use 5 (local5) - local use 6 (local6) - local use 7 (local7)	Choose a value that you will remember as being the IP VCR. Note: Various operating system daemons and processes have been found to utilize Facilities 4, 10, 13 and 14 for security/authorization, audit, and alert messages which seem to be similar. Various operating systems have been found to utilize both Facilities 9 and 15 for clock (cron/at) messages. Processes and daemons that have not been explicitly assigned a Facility value may use any of the "local use" facilities (16 to 21) or they may use the "user-level" facility (1) - and these are the values that we recommend you select.

Field

Field description

Usage tips

Host address 1 to 4

Enter the IP addresses of up to four Syslog receiver hosts.

The number of packets sent to each configured host is displayed next to its IP address.

Facility value

A configurable value for the purposes Choose from the following options:

0 -
1 -
2
3
4 -
5 -
6 -
7 -
8 -
9 -
10 -
11 -
12 -
13 -
14 -
15 -
16 -
17
18 -
19 -
20 -
22
23

of identifying events from the IP VCR on the Syslog host. kernel messages user-level messages - mail system - system daemons security/authorization messages (see Note 1) messages generated internally by syslogd line printer subsystem network news subsystem UUCP subsystem clock daemon (see Note 2) security/authorization messages (see Note 1) FTP daemon NTP subsystem log audit (see Note 1) log alert (see Note 1) clock daemon (see Note 2) local use 0 (local0) - local use 1 (local1) local use 2 (local2) local use 3 (local3) local use 4 (local4) 21 - local use 5 (local5) - local use 6 (local6) - local use 7 (local7)

Choose a value that you will remember as being the IP VCR.

Note: Various operating system daemons and processes have been found to utilize Facilities 4, 10, 13 and 14 for security/authorization, audit, and alert messages which seem to be similar.

Various operating systems have been found to utilize both Facilities 9 and 15 for clock (cron/at) messages.

Processes and daemons that have not been explicitly assigned a Facility value may use any of the "local use" facilities (16 to 21) or they may use the "user-level" facility (1) - and these are the values that we recommend you select.

Using syslog

The events that are forwarded to the syslog receiver hosts are controlled by the event log capture filter.

To define a syslog server, simply enter its IP address and then click Update syslog settings. The number of packets sent to each configured host is displayed next to its IP address.

Note: Each event will have a severity indicator as follows:

0 - Emergency: system is unusable (unused by the IP VCR)
1 - Alert: action must be taken immediately (unused by the IP VCR)
2 - Critical: critical conditions (unused by the IP VCR)
3 - Error: error conditions (used by IP VCR error events)
4 - Warning: warning conditions (used by IP VCR warning events)
5 - Notice: normal but significant condition (used by IP VCR info events)
6 - Informational: informational messages (used by IP VCR trace events)
7 - Debug: debug-level messages (used by IP VCR detailed trace events)

	VCR 2220
	host: VSL

Logging using syslog

Syslog settings

Using syslog

Related topics