Sidewinder firewall

[wrightp]

I want to get logs and data from my sidewinder firewall running 7.0.0.06. How do I do it?

[ericpartington1]

You should be able to set a syslog source from the sidewinder console.

Monitor > Firewall Reporter /syslog

use the export audit to syslog section at the bottom

click the plus

enter the ip address and facility (not sure it matters)

enable and save.

you will see events hitting your splunk server, just make sure to define a UDP input on port 514 and then set the sourcetype of the logs to something that is meaningful if you have other sources using that indexer or input.

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/21000/PD21665/en_US/...

[piebob]

a brief Googling session yielded this:

https://kc.mcafee.com/corporate/index?page=content&id=KB61298&cat=CORP_SIDEWINDER&actp=LIST

which suggests that there is an 'export' script that you could use. i suggest you review the documentation for Sidewinder to see if there are any other ways to get the logs out of it. the best option is probably to find out where Sidewinder writes its logs and point Splunk at that location using the information in

http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories