YALQ: yet another logging question

[MonkeyK]

I am trying to send my traffic logs to an install of Splunk on my workstation.

I think that this is supposed to work:
Logging
Remote Log Server: 192.168.1.19 (my desktop, wifi)
Default message log level: info
Log only messages more urgent than: all

Created a rule on my windows firewall "Allow syslog in" allowing UDP 514 inbound

But nothing goes to my workstation. I pulled up wireshark and set a filter of udp.port==514. I can see a bunch of Syslog events with DAEMON.INFO ... DHCP, but no traffic logs. None of it gets into Splunk either (that is a workstation problem). But what do I do to get the Remote logging to include traffic logs?

 

[ColinTaylor]

but no traffic logs.

What information were you expecting to see? You're just sending a copy of the syslog to another server. So if it isn't in the local syslog it won't be in the remote one either.

 

[MonkeyK]

Sorry, I did not read the local syslog. I just tried using what looked similar to the setup info for tools like http://www.linklogger.com. Is there another log that I can somehow send on to a monitoring tool?

 

[ColinTaylor]

I am not familiar with either product, but Splunk seems quite different to link logger.

You could enable the logging of packets at Firewall > General > Logged packets type = Both

But be warned that it will create a lot of entries in the syslog.

Alternatively you could enable SNMP. It depends on exactly what you are trying to achieve.

 

[MonkeyK]

Hmm. logging packets does seem like a log of logging. The main thing that I want is the traffic logs.
I'll take the DHCP and any DNS logs that I can get as well. But my initial goal is just traffic logs.

and there is nothing special about Splunk. It just accepts a bunch of log records and assumes that each one has a timestamp. After that the log record is searchable text (and there are things that you can do to make the text more searchable).
The difference between that and Link Logger is that Link Logger will normalize the data that it receives (it knows where to find src_ip, dest_ip, etc). Splunk needs to be taught.

 

[ColinTaylor]

The traffic data is not exportable.

 

[MonkeyK]

I see. So maybe I should try DD-WRT or Tomato? I'll have to take a look at those to see if they support remote traffic logging