{"id":110,"date":"2019-09-11T23:11:55","date_gmt":"2019-09-11T23:11:55","guid":{"rendered":"http:\/\/snehpatel.com\/?p=110"},"modified":"2019-09-11T23:11:55","modified_gmt":"2019-09-11T23:11:55","slug":"configuring-syslog-in-meraki-device","status":"publish","type":"post","link":"https:\/\/snehpatel.com\/index.php\/2019\/09\/11\/configuring-syslog-in-meraki-device\/","title":{"rendered":"Configuring Syslog in Meraki Device"},"content":{"rendered":"\n<p>Collection of logs is an important task if your company works with some kind of user data on-premise. And logging and monitoring of networking devices are also important. In this article, I will show how to set up Syslog on Meraki and using syslog-ng to receive those logs on to your logging server. <\/p>\n\n\n\n<p>First, let&#8217;s start with enabling the Syslog feature on the Meraki dashboard. <\/p>\n\n\n\n<ol class=\"wp-block-list\"><li> Network-wide -> General -> Reporting -> Syslog Server. Add logging server ip address and port.<\/li><li>Install syslog-ng on to the logging server. (sudo apt-get install syslog-ng)<\/li><li>Edit configuration for syslog-ng to listen 0.0.0.0 to port 514. Config file:  \/etc\/syslog-ng\/syslog-ng.conf. It will grab any Syslog sent to this server.<\/li><\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>source s_sys {\n    system();\n    internal();\nudp(ip(0.0.0.0) port(514));\n};<\/code><\/pre>\n\n\n\n<p>        4. Now define destination file to save the logs coming into the logging server.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>destination d_meraki { file(\"\/var\/log\/meraki.log\"); }; <\/code><\/pre>\n\n\n\n<p>      5. Define filters to save the log file the way you want.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>filter f_meraki { facility(meraki); };<\/code><\/pre>\n\n\n\n<p>    6. Now define everything together in the log section to make it sensible configuration.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>log { source ( s_sys ); filter( f_meraki ); destination ( d_meraki ); }; <\/code><\/pre>\n\n\n\n<p>    7. Save the file and restart Syslog-ng. <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl syslog-ng restart <\/code><\/pre>\n\n\n\n<p>Final file will look something like this: <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>@version:3.5\n@include \"scl.conf\"\n\n# syslog-ng configuration file.\n#\n# This should behave pretty much like the original syslog on RedHat. But\n# it could be configured a lot smarter.\n#\n# See syslog-ng(8) and syslog-ng.conf(5) for more information.\n#\n# Note: it also sources additional configuration files (*.conf)\n#       located in \/etc\/syslog-ng\/conf.d\/\n\noptions {\n    flush_lines (0);\n    time_reopen (10);\n    log_fifo_size (1000);\n    chain_hostnames (off);\n    use_dns (no);\n    use_fqdn (no);\n    create_dirs (no);\n    keep_hostname (yes);\n};\n\nsource s_sys {\n    system();\n    internal();\nudp(ip(0.0.0.0) port(514));\n};\n\ndestination d_cons { file(\"\/dev\/console\"); };\ndestination d_mesg { file(\"\/var\/log\/messages\"); };\ndestination d_auth { file(\"\/var\/log\/secure\"); };\ndestination d_mail { file(\"\/var\/log\/maillog\" flush_lines(10)); };\ndestination d_spol { file(\"\/var\/log\/spooler\"); };\ndestination d_boot { file(\"\/var\/log\/boot.log\"); };\ndestination d_cron { file(\"\/var\/log\/cron\"); };\ndestination d_kern { file(\"\/var\/log\/kern\"); };\ndestination d_mlal { usertty(\"*\"); };\n\ndestination d_meraki { file(\"\/var\/log\/meraki.log\"); }; \n\nfilter f_kernel     { facility(kern); };\nfilter f_default    { level(info..emerg) and\n                        not (facility(mail)\n                        or facility(authpriv)\n                        or facility(cron)); };\nfilter f_auth       { facility(authpriv); };\nfilter f_mail       { facility(mail); };\nfilter f_emergency  { level(emerg); };\nfilter f_news       { facility(uucp) or\n                        (facility(news)\n                        and level(crit..emerg)); };\nfilter f_boot   { facility(local7); };\nfilter f_cron   { facility(cron); };\n\nfilter f_meraki { facility(meraki); };\n\n#log { source(s_sys); filter(f_kernel); destination(d_cons); };\nlog { source(s_sys); filter(f_kernel); destination(d_kern); };\nlog { source(s_sys); filter(f_default); destination(d_mesg); };\nlog { source(s_sys); filter(f_auth); destination(d_auth); };\nlog { source(s_sys); filter(f_mail); destination(d_mail); };\nlog { source(s_sys); filter(f_emergency); destination(d_mlal); };\nlog { source(s_sys); filter(f_news); destination(d_spol); };\nlog { source(s_sys); filter(f_boot); destination(d_boot); };\nlog { source(s_sys); filter(f_cron); destination(d_cron); };\n\nlog { source ( s_sys ); filter( f_meraki ); destination ( d_meraki ); }; \n\n\n# Source additional configuration files (.conf extension only)\n@include \"\/etc\/syslog-ng\/conf.d\/*.conf\"\n\n\n# vim:ft=syslog-ng:ai:si:ts=4:sw=4:et:<\/code><\/pre>\n\n\n\n<p>You can use different SIEM and get output in a proper indexed format. My next post will show you how to get this log into ELK stack.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Collection of logs is an important task if your company works with some kind of user data on-premise. And logging and monitoring of networking devices are also important. In this article, I will show how to set up Syslog on Meraki and using syslog-ng to receive those logs on to your logging server. First, let&#8217;s &#8230; <a title=\"Configuring Syslog in Meraki Device\" class=\"read-more\" href=\"https:\/\/snehpatel.com\/index.php\/2019\/09\/11\/configuring-syslog-in-meraki-device\/\" aria-label=\"Read more about Configuring Syslog in Meraki Device\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3,9],"tags":[35,51],"class_list":["post-110","post","type-post","status-publish","format-standard","hentry","category-logging","category-systme","tag-logs","tag-system"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Configuring Syslog in Meraki Device - Sneh Patel<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/snehpatel.com\/index.php\/2019\/09\/11\/configuring-syslog-in-meraki-device\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Configuring Syslog in Meraki Device - Sneh Patel\" \/>\n<meta property=\"og:description\" content=\"Collection of logs is an important task if your company works with some kind of user data on-premise. And logging and monitoring of networking devices are also important. In this article, I will show how to set up Syslog on Meraki and using syslog-ng to receive those logs on to your logging server. First, let&#8217;s ... Read more\" \/>\n<meta property=\"og:url\" content=\"https:\/\/snehpatel.com\/index.php\/2019\/09\/11\/configuring-syslog-in-meraki-device\/\" \/>\n<meta property=\"og:site_name\" content=\"Sneh Patel\" \/>\n<meta property=\"article:published_time\" content=\"2019-09-11T23:11:55+00:00\" \/>\n<meta name=\"author\" content=\"Sneh Patel\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sneh Patel\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2019\\\/09\\\/11\\\/configuring-syslog-in-meraki-device\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2019\\\/09\\\/11\\\/configuring-syslog-in-meraki-device\\\/\"},\"author\":{\"name\":\"Sneh Patel\",\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#\\\/schema\\\/person\\\/a39105bc63f7e11a0e07b12a4c3dda73\"},\"headline\":\"Configuring Syslog in Meraki Device\",\"datePublished\":\"2019-09-11T23:11:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2019\\\/09\\\/11\\\/configuring-syslog-in-meraki-device\\\/\"},\"wordCount\":196,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#\\\/schema\\\/person\\\/a39105bc63f7e11a0e07b12a4c3dda73\"},\"keywords\":[\"logging\",\"System\"],\"articleSection\":[\"Logging\",\"System\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2019\\\/09\\\/11\\\/configuring-syslog-in-meraki-device\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2019\\\/09\\\/11\\\/configuring-syslog-in-meraki-device\\\/\",\"url\":\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2019\\\/09\\\/11\\\/configuring-syslog-in-meraki-device\\\/\",\"name\":\"Configuring Syslog in Meraki Device - Sneh Patel\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#website\"},\"datePublished\":\"2019-09-11T23:11:55+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/snehpatel.com\\\/index.php\\\/2019\\\/09\\\/11\\\/configuring-syslog-in-meraki-device\\\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#website\",\"url\":\"https:\\\/\\\/snehpatel.com\\\/\",\"name\":\"Sneh Patel\",\"description\":\"Cyber Security Blog\",\"publisher\":{\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#\\\/schema\\\/person\\\/a39105bc63f7e11a0e07b12a4c3dda73\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/snehpatel.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/snehpatel.com\\\/#\\\/schema\\\/person\\\/a39105bc63f7e11a0e07b12a4c3dda73\",\"name\":\"Sneh Patel\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i0.wp.com\\\/snehpatel.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/snehpatel.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/snehpatel.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1\",\"width\":672,\"height\":222,\"caption\":\"Sneh Patel\"},\"logo\":{\"@id\":\"https:\\\/\\\/i0.wp.com\\\/snehpatel.com\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1\"},\"sameAs\":[\"http:\\\/\\\/snehpatel.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Configuring Syslog in Meraki Device - Sneh Patel","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/snehpatel.com\/index.php\/2019\/09\/11\/configuring-syslog-in-meraki-device\/","og_locale":"en_US","og_type":"article","og_title":"Configuring Syslog in Meraki Device - Sneh Patel","og_description":"Collection of logs is an important task if your company works with some kind of user data on-premise. And logging and monitoring of networking devices are also important. In this article, I will show how to set up Syslog on Meraki and using syslog-ng to receive those logs on to your logging server. First, let&#8217;s ... Read more","og_url":"https:\/\/snehpatel.com\/index.php\/2019\/09\/11\/configuring-syslog-in-meraki-device\/","og_site_name":"Sneh Patel","article_published_time":"2019-09-11T23:11:55+00:00","author":"Sneh Patel","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Sneh Patel","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/snehpatel.com\/index.php\/2019\/09\/11\/configuring-syslog-in-meraki-device\/#article","isPartOf":{"@id":"https:\/\/snehpatel.com\/index.php\/2019\/09\/11\/configuring-syslog-in-meraki-device\/"},"author":{"name":"Sneh Patel","@id":"https:\/\/snehpatel.com\/#\/schema\/person\/a39105bc63f7e11a0e07b12a4c3dda73"},"headline":"Configuring Syslog in Meraki Device","datePublished":"2019-09-11T23:11:55+00:00","mainEntityOfPage":{"@id":"https:\/\/snehpatel.com\/index.php\/2019\/09\/11\/configuring-syslog-in-meraki-device\/"},"wordCount":196,"commentCount":0,"publisher":{"@id":"https:\/\/snehpatel.com\/#\/schema\/person\/a39105bc63f7e11a0e07b12a4c3dda73"},"keywords":["logging","System"],"articleSection":["Logging","System"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/snehpatel.com\/index.php\/2019\/09\/11\/configuring-syslog-in-meraki-device\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/snehpatel.com\/index.php\/2019\/09\/11\/configuring-syslog-in-meraki-device\/","url":"https:\/\/snehpatel.com\/index.php\/2019\/09\/11\/configuring-syslog-in-meraki-device\/","name":"Configuring Syslog in Meraki Device - Sneh Patel","isPartOf":{"@id":"https:\/\/snehpatel.com\/#website"},"datePublished":"2019-09-11T23:11:55+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/snehpatel.com\/index.php\/2019\/09\/11\/configuring-syslog-in-meraki-device\/"]}]},{"@type":"WebSite","@id":"https:\/\/snehpatel.com\/#website","url":"https:\/\/snehpatel.com\/","name":"Sneh Patel","description":"Cyber Security Blog","publisher":{"@id":"https:\/\/snehpatel.com\/#\/schema\/person\/a39105bc63f7e11a0e07b12a4c3dda73"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/snehpatel.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/snehpatel.com\/#\/schema\/person\/a39105bc63f7e11a0e07b12a4c3dda73","name":"Sneh Patel","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i0.wp.com\/snehpatel.com\/wp-content\/uploads\/2020\/09\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1","url":"https:\/\/i0.wp.com\/snehpatel.com\/wp-content\/uploads\/2020\/09\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1","contentUrl":"https:\/\/i0.wp.com\/snehpatel.com\/wp-content\/uploads\/2020\/09\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1","width":672,"height":222,"caption":"Sneh Patel"},"logo":{"@id":"https:\/\/i0.wp.com\/snehpatel.com\/wp-content\/uploads\/2020\/09\/cropped-Slide4-1.jpg?fit=672%2C222&ssl=1"},"sameAs":["http:\/\/snehpatel.com"]}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/posts\/110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/comments?post=110"}],"version-history":[{"count":0,"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/posts\/110\/revisions"}],"wp:attachment":[{"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/media?parent=110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/categories?post=110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/snehpatel.com\/index.php\/wp-json\/wp\/v2\/tags?post=110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}