Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 2 subscribers
  • Views 1670 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[7.505] remote logserver question - tcp or udp?

Joffer
I'm testing out splunk and I want one of our astaro (7.505) to send logs to the splunk server. Does Astaro support syslog over tcp? or is it only udp?


This thread was automatically locked due to age.
  • 0
    Do you really have a need for the overhead of TCP on the data stream?

    If so, just create a new service definition for TCP 514 (or whatever port you need) and use that in the Remote Syslog Server configuration.
  • 0
    I just wondered what the default was and what it supported.. from what you say it supports both... I need tcp on one of the firewalls since I cant have logs go lost due to udp packets being discarded or anything... PCI compliance...
  • 0 in reply to Joffer
    Yes, we support both protocols for remote Syslog.

    For redundancy, keep in mind that you have log copies on the ASG, and that you can also send logs by email, FTP, SMB, or SCP/SSH.  Some combination of those should address almost any archival and/or compliance requirements.