Syslog forwarding
Network devices generate various events that are logged locally, where they can be reviewed and analyzed by an administrator. However, if your network hosts a large number of devices, collecting event logs from each of these devices would be time-consuming and impractical.
Syslog, or System Logging Protocol, is a standard protocol that solves this issue by sending system logs or event messages to a central syslog server. This protocol is enabled on most network devices including routers, switches, and firewalls. Syslog is also available on Unix and Linux-based systems, and web servers like Apache.
EventLog Analyzer acts as a syslog server and collects event messages from devices across your network. It's also capable of forwarding the collected logs to a third-party server or a security information and event management (SIEM) application.
How EventLog Analyzer's syslog forwarder works
EventLog Analyzer’s syslog forwarder is designed to receive syslogs and send the data to the appropriate system. EventLog Analyzer listens in on the designated User Datagram Protocol (UDP) port, which by default is port 513. On receiving the logs, the UDP forwarder in EventLog Analyzer forwards the information to the specified destination server. Logs from syslog devices are forwarded as raw logs, while logs from other event sources are converted to RFC3164 or RFC5424, and forwarded it to the desired destination host.
The biggest advantage of EventLog Analyzer is that it can function as both a syslog server and a forwarder.
The benefits of syslog forwarding
Syslog forwarding offers a way to ensure that critical events are logged and stored in a separate location from the original server. An attacker’s first move after compromising a system is to cover the tracks they left in the log, but these forwarded events will be out of their grasp. Replication of the collected logs in another server can be used as a backup if the original data is lost. The replicated data can also be used to cross-check if the original data has been tampered with.
Other features
EventLog Analyzer offers log management, file integrity monitoring, and real-time event correlation capabilities in a single console that help meeting SIEM needs, combat security attacks, and prevent data breaches.
Analyze event log data to detect security events such as file/folder changes, registry changes, and more. Study DDoS, Flood, Syn, and Spoof attacks in detail with predefined reports.
Analyze application log from IIS and Apache web servers, Oracle & MS SQL databases, DHCP Windows and Linux applications and more. Mitigate application security attacks with reports & real-time alerts.
Monitor all types of log data from Active Directory infrastructure. Track failure incidents in real-time and build custom reports to monitor specific Active Directory events of your interest.
Monitor and track privileged user activities to meet PUMA requirements. Get out-of-the-box reports on critical activities such as logon failures, reason for logon failure, and more.
Perform in-depth forensic analysis to backtrack attacks and identify the root cause of incidents. Save search queries as alert profile to mitigate future threats.
Need Features? Tell Us
If you want to see additional features implemented in EventLog Analyzer, we would love to hear. Click here to continue
Free Edition
