topic Re: How can I send only only the "Most Recent User Activities" to a remote syslog server? in ZoneDirector

How can I send only only the "Most Recent User Activities" to a remote syslog server?

steven_blum_594 — Thu, 19 Sep 2013 16:52:53 GMT

Can I send only the "Most Recent User Activities" to a remote syslog? I don't want to collect all the radius_client, radius_server, cluster... information. Syslog server is solarwinds. I am running two ZD3000 Active/Stanby configuration.

I need the user information as part of my security logging.

Re: How can I send only only the "Most Recent User Activities" to a remote syslog server?

max_o_driscoll — Fri, 20 Sep 2013 08:44:40 GMT

You can send all messages to a syslog server and then filter for the ones you need. However looking at my last 10,000 (default) entries there are no "most recent user activities" entries.
Would expect they appear under "info" or "warning" headings but those seem to have few entries. It seems almost everything comes under the "error" and "debug" heading.
Then need to find the exact wording ruckus use for messages that relate to "most recent user activities" and text filter on that.

I'm using syslog watcher personal. In general the log entries tend to be pretty cryptic so don't expect plain english!

In very pragmatic terms if you log everything then you at least have the data to fulfill your security requirement even though you are collecting more than needed. Hmm.

Re: How can I send only only the "Most Recent User Activities" to a remote syslog server?

mulyantan_t — Wed, 15 Oct 2014 07:50:11 GMT

hello,
i just installed syslog watcher personal, whats next step?

Re: How can I send only only the "Most Recent User Activities" to a remote syslog server?

bill_burns_6069 — Thu, 16 Oct 2014 04:45:29 GMT

point your zonedirector at your syslog server.