Syslog Server Setup

Step 1: Enable Syslog Server

First, navigate to the "Security" tab in Network Backup Manager. Here you'll find the syslog server configuration options.

The built-in syslog server allows you to collect logs from all your network devices in one central location. This is essential for security monitoring and troubleshooting.

Step 2: Configure Server Settings

Click on "Syslog Server Settings" to open the configuration dialog. Here you can set the listening port (default is 514) and choose which network interfaces to listen on.

For security, you may want to restrict the syslog server to only listen on specific network interfaces, especially if you have multiple network connections.

Step 3: Start the Syslog Service

Once configured, click "Start Syslog Server" to begin accepting log messages. The status indicator will change to green when the service is running successfully.

You can verify the server is running by checking the status message and testing connectivity from a network device.

Step 4: Configure Network Devices

Now you need to configure your network devices to send their log messages to Network Backup Manager. For Cisco devices, use the following command:

logging host [SERVER_IP_ADDRESS]

Replace [SERVER_IP_ADDRESS] with the IP address of the computer running Network Backup Manager. You may also want to set the logging level: logging trap informational

Step 5: View and Monitor Logs

Return to the Security tab to view incoming syslog messages. The system automatically categorizes messages by severity and can highlight security-related events.

You can filter logs by device, time range, severity level, or search for specific messages. Critical security events will be highlighted in red for immediate attention.

Step 6: Set Up Alerts (Optional)

To get notified of important security events, configure email alerts. Go to Settings → Email Alerts and create rules for specific syslog message patterns.

You can create alerts for login failures, configuration changes, interface status changes, and other critical events. This ensures you're immediately notified of potential security issues.