topic Re: Sidewinder firewall in Getting Data In

Sidewinder firewall

wrightp — Wed, 18 Aug 2010 01:18:39 GMT

I want to get logs and data from my sidewinder firewall running 7.0.0.06. How do I do it?

Re: Sidewinder firewall

piebob — Wed, 18 Aug 2010 03:48:01 GMT

a brief Googling session yielded this:

https://kc.mcafee.com/corporate/index?page=content&id=KB61298&cat=CORP_SIDEWINDER&actp=LIST

which suggests that there is an 'export' script that you could use. i suggest you review the documentation for Sidewinder to see if there are any other ways to get the logs out of it. the best option is probably to find out where Sidewinder writes its logs and point Splunk at that location using the information in

http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories

Re: Sidewinder firewall

ericpartington1 — Thu, 02 Sep 2010 05:47:52 GMT

You should be able to set a syslog source from the sidewinder console.

Monitor > Firewall Reporter /syslog

use the export audit to syslog section at the bottom

click the plus

enter the ip address and facility (not sure it matters)

enable and save.

you will see events hitting your splunk server, just make sure to define a UDP input on port 514 and then set the sourcetype of the logs to something that is meaningful if you have other sources using that indexer or input.

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/21000/PD21665/en_US/fe_70102_rn_a.pdf