Syslog Devices

Cyfin is designed to work with your syslog-enabled device. It integrates easily into your current system configuration.

Cyfin Syslog Server

Cyfin Syslog Server is a built-in syslog server that gathers all of your data from your configured syslog devices at no additional cost allowing you to generate a single report. Cyfin Syslog Server supports a number of gateway devices and firewalls including the following:

• Astaro Security Gateway
• Barracuda Networks
• Bloxx Proxy
• Check Point Syslog
• EdgeWave iPrism
• FortiGate
• Palo Alto Firewall
• SonicWall
• WatchGuard

Cyfin - Syslog Device Configuration

Log File Format

Cyfin needs certain log file fields to process your logs. The following log file fields are required:

• Date/Time
• URL - If the file contains the protocol, domain/host name, and path separately, the URL can be created from these fields.
• IP Address

In addition, the following optional fields are optimal for more detailed reporting:

• User
• Size/Bytes
• Reason/Status

Configuration Steps

Cyfin Syslog Server listens for syslog messages from your device. Both UDP-based and TCP-based messages are supported.

1. Select the log file configuration in Cyfin for your syslog device.
2. Specify the Directory in which the log files will be created. The default directory is [InstallPath]\wc\cf\log.
3. Select Enable Syslog Server.
4. For Port Type, select UDP or TCP for the Internet protocol you want to use.
5. In the Listening Port field, the default port number is 1455. The listening port will be used by your syslog device to transfer the data. You may change this number if necessary.
6. At your syslog device, specify the IP address of the Cyfin server and the listening port, and submit the syslog messages.
7. Your log files will be created and displayed in the Log File Viewer in Cyfin.
8. If you have many of the same syslog devices, use one log file configuration with one listening port, and point each device to the same listening port.