Meraki has a syslog option. To configure a Meraki to push logs to a syslog server, open your Meraki Dashboard and click on a device. From there, click on “Alerts & administration”.
At the “Alerts & administration” page scroll down to the Logging section. Click on the “Add a syslog server” link and type the IP address of your syslog servers name or IP. Put the port number into the Port field. Choose what types of events to export. This could be Event Log, Flows or URLs, where:
- Event Log: The messages from the dashboard under Monitor > Event log.
- Flows: Inbound and outbound traffic flows generate syslog messages that include the source and destination and port numbers.
- URL: HTTP GET requests generate syslog entries.
Note that you can direct each type of traffic to a different syslog server.
krypted April 16th, 2014
Posted In: cloud, Mac Security, Network Infrastructure
514, firewall, logger, logstash, MAC, Meraki, router, stashbox, syslog, syslog-ng
There are a number of tools available for using Syslog in a Windows environment. I’ll look at Snare as it’s pretty flexible and easy to configure. First download the snare installation executable from http://sourceforge.net/projects/snare. Once downloaded run the installer and simply follow all of the default options, unless you’d like to password protect the admin page, at which point choose that. Note that the admin page is by default only available to localhost.
Once installed, run the “Restore Remote Access to Snare for Windows” script.
Then open http://127.0.0.1:6161 and click on Network Configuration in the red sidebar. There, we can define the name that will be used in syslog (or leave blank to use the hostname), the port of your syslog server (we used 514 here) and the address of your syslog server (we used logger here but it could be an IP or fqdn).
Once you have the settings you’d like to use, scroll down and save your configuration settings. Then, open Services and restart the Snare service.
Then run the Disable Remote Access to Snare for Windows option and you’re done. Now, if you’re deploying Snare across a lot of hosts, you might find that scripting the config is faster. You can send the Destination hostname (here listed as meh) and Destination Port (here 514) via regedit commands (Destination and DestPort respectively) and then restart the service.
I’ll do another article at some point on setting up a logstash server to dump all these logs into. Logstash can also parse the xml so you can search for each attribute in the logs and with elasticsearch/hadoop/Kibana makes for an elegant interface for parsing through these things.
krypted April 13th, 2014
Posted In: Active Directory, Windows Server, Windows XP
Active Directory, Exchange, logstash, MAC, server, snare, syslog, windows