UTM Syslog - Example: Paessler PRTG

Paessler PRTG set up as syslog server for Securepoint UTM

Last adaption: 08.2022

New:

Reference to unencrypted transmission

notempty

This article refers to a Beta version

-

Foreword

Syslog data from the UTM can be captured with third-party solutions.
Shown here is the example of PRTG from Paessler.

Since the syslog is not encrypted, a VPN tunnel should always be used when connecting via internet

Requirement

Installed PRTG on a Windows system
(Download here: https://www.paessler.com/prtg)
See also system requirements for PRTG
Sufficient license for the additional sensors to monitor the UTM
- Syslog for a UTM corresponds to 1 sensor
- the freeware version allows commercial use and includes up to 100 sensors

PRTG requires its own sender email address to send status emails.
If the syslog server with PRTG is not located within your own mail infrastructure, it can lead to the rejection of mails even if the UTM is configured correctly (Fake sender).
A workaround for this is, for example, an Allow-List mail filter rule for a monitoring mail address or adding to the allowed mail server IPs.

Preliminary configuration on the UTM

Syslog settings Syslog settings
The connection of the UTM is configured on a syslog server (syslogd).
Caption	Value	Description	Appliance Settings UTMuser@firewall.name.fqdnNetwork
Log the UTM hostname in the syslog messages:	No	In case of Yes activation the hostname is transmitted with
Syslog-Server Syslog-Server
Add Syslog Server
IP / Hostname:	syslog.ttt-point.de	IP address or host name of the syslog server. notempty If more than one ip-address is assigned to the hostname while you are using Round Robin DNS, the syslog messages may be send to another server each time the service gets restarted. Additionally you won't be protected against DNS Spoofing anymore. Please make sure only one address is assigned to the hostname.
Port:	514	Default port for syslog messages
Protocol	udp	Default protocol for syslog messages. Alternatively tcp can be selected here. PRTG requires udp as protocol for syslog

The Securepoint appliance uses an rfc5424-based protocol format. Alternatively, the following template can be used for syslog servers. This template is automatically recognized by some syslog servers, but must be entered manually for others. template rfc5424_and_116_compat_format {template("<${PRI}>1 ${ISODATE} - ${PROGRAM} $(or ${PID} '-') - - ${MSG}\n");}; <${PRI}>1 ${ISODATE} - ${PROGRAM} $(or ${PID} '-') - - ${MSG}\n