Syslog down - no events on XG

Aditya Patel sachingurung, 

is this a bug or a by design?

Thanks

Hi lferrara, 

You may check on Iview logs if there is any incoming traffic and on XG for port 514 if the traffic is sent out to the syslogs server. 

Please note that the Port 514 needs to be open on the machine where the IView is installed and please post the settings of the logs and Syslog server.

Hi lferrara, 

You may check on Iview logs if there is any incoming traffic and on XG for port 514 if the traffic is sent out to the syslogs server. 

Please note that the Port 514 needs to be open on the machine where the IView is installed and please post the settings of the logs and Syslog server.

Thanks Aditya.

Maybe the situation is not clear. Everything is working as expected.What I am saying is: if the connection between XG and iView is not working anymore (firewall between them, syslog down, etc), XG does not warn the users or an error appears in any log. So you do not know if the XG still has a connection and it is pushing logs to XG.

XG does not write nothing inside the logs.

Thanks

Hi lferrara, 

Ah, well in this case, the traffic sent to the Syslog server is UDP and pretty much one way. There is no check if the IView has received all the logs, but we could raise a feature request to check the status of the connection using a sync feature. 

Thanks Aditya Patel 

I opened a feature request:

https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/19746520-syslog-down-or-not-reachable-xg-does-not-log-any

Please vote!

Thanks