Help with Syslogging

[Concrete]

Hi There
I have recently started working with CheckPoint FW-1 NG with AI and HFA 14 running on a solaris box.

Anywho here's problem I am trying to get the Checkpoint SmartView log viewer run on a win2k box to also read syslog messages from other products like routers and pix. So far my attempts at solving this have been unsuccesful.

Any Help would be appreciated

Thank You

[Concrete]

No ideas anyone?

I have found an executable call syslog in the checkpoint folders and have tried that (syslog 514 all).
The executable starts running but it always hangs, and doesn't return to the CLI. So I thought it may need to keep running and I ran it in the background using nice nhup syslog 514 all&.

When I do a ps -ef after running the executable there is a process running and the SmartView Tracker gets a log stating the syslog daemon is running. But doing a netstat and grepping for port 514 shows nothing, so it doesn't seem to be listening and SmartView is not getting any logs from my routers or pix.

Once again I am running Checkpoint NG with AI and HFA 14. It is set up as a management console and I am trying to make it so that SmartView will show all logs instead of having to use 2 programs, one for checkpoint and one for the syslog devices.

Once again ThankYou for you time and help
Concrete

[stuartgreen]

i'm not sure you can use smartview tracker as a standard syslog server? I think the new release of eventia reporter can import logs from other sources and perform analysis on them. using the check point log server / management server as a single log managment point is not something i've heard of before

[Concrete]

Darn...I was under the impresstion that there was some form of compatability with syslogs.

http://www.aerasec.de/security/advis...slog-crash.txt
The document lead me to believe that the daemon would allow the logging of syslogs.

As well there is an optiong under aditional logging in the Dashboard program that allows for the recieveing of syslogs. But it doesn't seem to be working any better then the daemon.

O well thanks for your reply, I will start looking into other options starting with this eventia reporter.

Thank You
Concrete

[jmcgrady]

I have a pix logging to my smartcentre. The entries appear. But they are not parsed. They're just a blank entry except for date, time, origin, and type (log). If i drill into the 'log' field i can see the syslog entry as one big text spiel. Is it possible for Smartcentre to parse syslog entries more intelligently?