More Information > Syslog Reports

Overview

Syslog is a client-server protocol for forwarding log messages from the application or device that produces the logs to a syslog receiver. Use syslog to accumulate log messages on a system remote from the search appliance.

You configure syslog from the Administration > Network Settings page.

Messages sent from the search appliance to a syslog receiver are assigned the priority Informational. The search appliance sends message to the syslog receiver every 5 minutes.

The syslog facility value identifies the device from which a message originates. You can set the syslog facility to any local use level. The Facility setting has no effect on which messages are logged. For more details on the syslog protocol, see RFC 3164.

You can use syslog to generate your own reports on search appliance activity. The following sections have information on how to test a syslog setup and on the syslog message format.

Testing a Syslog Configuration

After you configure a syslog server from the Administration > Network Settings page, verify that the search appliance is sending syslog messages to your syslog server. You need a network utility that lets you listen on a socket and print everything that is received on the socket. The following example uses netcat, a free utility available for both Unix and Windows.

To test a syslog configuration:

1. Log in to the syslog server host.
2. Ensure that netcat is installed on the syslog server host.
3. On the syslog server host, open a terminal window.
4. Start netcat. For example, on a UNIX system, use the following command:

      # nc -l -p 514 -u

5. Start a web browser and perform some searches on the search appliance.

   Within ten minutes, web server log messages should begin to appear in the terminal window where netcat is running.

About the Syslog Message Format

Each syslog message has three parts.

• The first part is called PRI (see the description of the syslog protocol (RFC 3164) for more more information).
• The second part is the HEADER (see the description of the syslog protocol (RFC 3164) for for more information).
• The third part is the MSG, the web server log message.

A typical syslog message looks like this:

The following table contains information about the PRI and HEADER sections of the syslog message.

The following table contains information about the MSG section of the syslog message.