I would like to send all logs to a Splunk to use syslog.

Hello,

I would like to send all logs a Splunk to use syslog.

I had done to set Splunk IP on syslog server of log setting and set All sessions of logging options on the all rules.

However, the Splunk has been getting only IPS logs, not all session logs.

Can you tell me what i should do to check or resolve it?

Thanks and Regards,

Kic Lee

Explorer

I hope it would be helpful to someone.

My FW was set to send syslog when severity of log is equal or high than warning.

Denied traffic logs are classified warning of severity.

Allowed traffic logs are classified notice of severity.

So It has been working well after changed the configuration from warning to notice.

Good luck.

Sign up