syslog kicking my ass

[st4rk]

I have my cisco router acl setup to block people from going to myspace. I want it to log all denied traffic to myspace.

I installed a free syslog daemon on my box called kiwi. It installed fine and got a test message, but when I tried to access myspace from my box, it wasn't receiving the logs from the cisco server, even though cisco said it had sent some messages to the syslog server.

I uninstalled kiwi and then tried winsyslog, after installing I could not figure out for the life of me where the hell winsyslog keeps its logfile.

So my question is, what product do you guys use for syslog and cisco routers?

Thanks.

 

[computadorka]

Arcsight!

lol

but for real, i dont know that you want to use syslog for this purpose, that is what a proxy server would be used for.

Let the router route, and the firewall/proxy filter.

 

[unix_foo]

I use Kiwi (full version) .

Does the message show up on IOS log at all?

 

[st4rk]

Let the router route, and the firewall/proxy filter.

The outbound acl on the external router interface also has some entries to help against DoS attacks, so I kinda want to know about that too......

 

[archivalbackup]

Make sure to allow the syslog through the firewall on your computer that is monitoring / running Kiwi.

Make an exception for port 514 UDP.

I use Kiwi with no problems for syslogging.

Edit: Cisco Syslog instructions http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v50/instlgd/pfss.htm