AC66U - guide for setting up External logging

[lurc]

Hi.
I am looking to set up external logging for the AC66U. The idea is to ingest them in splunk. However I can not find a way to set up external logging in the web GUI.
Can anybody please help me with a guide on setting up external logging?

 

[RMerlin]

Hi.
I am looking to set up external logging for the AC66U. The idea is to ingest them in splunk. However I can not find a way to set up external logging in the web GUI.
Can anybody please help me with a guide on setting up external logging?

Administration -> System. Enter the IP of the remote syslog server on that page.

 

[lurc]

Thanks. I finally got a connection. Any way to route the traffic logs as well?

 

[RMerlin]

Thanks. I finally got a connection. Any way to route the traffic logs as well?

Enable firewall logging on the Firewall page. Logging will go to syslog.

 

[JohnnyS]

Logging questions.

I need to log the entries listed under the "Connections" tab in the "System Log" page of the router configuration. How can I do this? I need the internal NATted address specifically so I can track down a particular system.

The reason I need this is that I have a number of systems on my network, some wireless and some wired. I can see dangerous traffic outbound on my external NIDS, but even if I turn the firewall logs on for "all" traffic I can't tell which internal system sent the traffic.

Thanks in advance!

JS

 

[RMerlin]

I need to log the entries listed under the "Connections" tab in the "System Log" page of the router configuration. How can I do this? I need the internal NATted address specifically so I can track down a particular system.

The reason I need this is that I have a number of systems on my network, some wireless and some wired. I can see dangerous traffic outbound on my external NIDS, but even if I turn the firewall logs on for "all" traffic I can't tell which internal system sent the traffic.

Thanks in advance!

JS

These aren't a realtime display you can monitor or a logfile getting dumped - it's a list generated by running the netstat-nat command. You can manually run the same command over Telnet.

 

[JohnnyS]

I found it.

I found what I needed in one of your other posts:

http://forums.smallnetbuilder.com/showthread.php?t=20860&highlight=syslog+connections

Specifically, telnet in and run the command "iptables -I FORWARD 7 -i br0 -j logaccept"

That gives me the internal/external IP addresses and the ports with a timestamp. I should be able to correlate that with my Snort alerts, so I should be able to identify the offending internal system.

JS