For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Wintrode_61162's avatar
Wintrode_61162
Icon for Nimbostratus rankNimbostratus
Oct 03, 2012

UDP Syslog Monitor

I am trying to think of an easy way to monitor the health of ArcSight Collectors listening for UDP Syslog. We have a very high volume syslog environment and want to institute load balancing of the co...
config
design
Hamish's avatar
Hamish
Icon for Cirrocumulus rankCirrocumulus
Oct 05, 2012
If you enable tcp syslog (syslog-ng) you can send the logs via a tcp connection rather than a fire & forget UDP message. Does the ArcSight collector have a tcp option?

 

 

If you really need UDP then you probably need to combine an ICMP query with a UDP message... ICMP checks the box is up/down. Then the UDP will get nothing back IF the syslog receiver is listening, and SHOULD receive an ICMP port closed message if nothing is listening but the server is up. I'm not sure if a UDP monitor looks for the ICMP coming back if nothing is listening... It might, but I haven't checked. if it doesn't you'll need to do this as an external monitor.

 

 

H