My goal was to have my Mac receive syslog messages from a Cisco ASA5506 firewall configured as a VPN server and also running the new FirePOWER IPS features. I wanted most of the messages from the ASA to be sent to one file, a subset of those messages to be sent to a second file but not to the first, and all the messages from the FirePOWER module in the ASA to be sent to a third file (that FirePOWER module is managed via a different IP address, so it looks like a different device as far as logging is concerned).
Here's how I set things up to meet that goal:
Step 1. Install syslog-ng. I used the MacPorts utility ("macports.org"), which is very simple. The alternative "Homebrew" utility doesn't seem to include syslog-ng as an available package so that doesn't appear to be an option. You could also build syslog-ng from scratch from the sources at Balabit.com and get the latest version, but that's quite a bit more work. Since I'm just using basic syslog features the old version available via MacPorts is fine.
The MacPorts installer also shows you the commands necessary to install appropriate "LaunchDaemon" files so syslog-ng will start at boot time, which is an added convenience. It doesn't touch the "/System" folder, so the new security features in El Capitan that block access to that folder aren't a problem.
Step 2. Create a "syslog-ng.conf" file to implement the desired logging functionality. I started by downloading an old version of the syslog-ng Admin Guide, since MacPorts installs version 3.0.8 instead of the current 3.7. A Google search for "syslog-ng 3.0 Administrator Guide" turns up a link to the PDF version of that guide from "my.balabit.com". Based on this reference, I generated the configuration file below.
Step 3. Modify the "/etc/newsyslog.conf" file so it will rotate the log files so they don't grow without bound. The important parameter to include is the PID file for syslog-ng, since the newsyslog process needs to know which process to send a HUP signal to so it'll know the destination files have been rotated. If you don't do this logging will stop the next time newsyslog rotates the files. Here's what one of my new entries in "newsyslog.conf" looks like:
/Users/me/Logs/FirePOWER.log 640 20 1000 * J /opt/local/var/syslog-ng.pid
This line is just a copy of the other lines already in that config file, but I changed the number of files to keep to 20 and I added the path to the syslog-ng PID file to the end. You'll want a similar line for each of the log files syslog-ng is writing to.
Step 4. Modify the syslog configs on the ASA and the FirePOWER module to use the new destination UDP port for log messages. The default is 514, but since the existing Mac OS X syslog uses that port, I chose to use 10514 instead.
Step 5. Once I had all the various pieces in place I chose to just restart my Mac, though you could also just kick the appropriate processes manually to force them to restart with the new configs. Since I also wanted to verify that syslog-ng would continue to work after a reboot I had to do a restart anyway.
Below is the "syslog-ng" config file I ended up with (it goes in "/opt/local/etc", since MacPorts puts everything it does somewhere in "/opt" to keep it out of the way of Mac OS X stuff). The "options" section does what it sounds like, and I just went through the Admin Guide Reference for the Global Options and chose values that seemed reasonable. The "Sources" section is where the non-standard UDP port is specified, and it also includes an internal source for handling log messages from syslog-ng itself. I haven't found these to be particularly useful, however, so it could probably safely be left out. The "Destination" section specifies the individual log files you'll send individual syslog messages to, and I chose to put them in a subdirectory of my account. Normally log messages go in "/var/log", but I thought it might be good to keep my logs completely separate from other system logs. The "Filters" section is where the message processing happens and supports quite a wide range of features. You'll want to keep the Admin Guide nearby if you decide to get at all fancy with this. I'm matching the messages based on either the hostname or IP address of the device sending the the syslog message, and for some of the logs I'm explicitly including or excluding individual messages based on text that appears in the syslog message body (this is a Regular Expression match, by the way, so it's quite flexible and powerful). The final "Log Paths" section is where you associate Sources, Filters, and Destinations to actually send the incoming syslog messages to the desired destination files. Finally, I chose to take advantage of the flexible nature of the config file syntax to format my config in a way that I find easier to follow. Most of the other sample syslog-ng config files I've seen online tend to run the various fields together onto single lines. It makes for a shorter looking file, but I find it easy to miss important details that way.
@version:3.0
options {
flush_lines(0);
normalize_hostnames(yes);
owner("root");
group("admin");
perm(0640);
use_dns(no);
dns_cache_hosts(/etc/hosts);
stats_freq(3600);
};
#########################################################
# Sources
#
source S_LOCAL {
internal();
};
source SYSLOG_UDP {
udp(port(10514));
};
#########################################################
# Destination Log Files
#
destination D_SYSLOG-NG {
file("/Users/me/Logs/syslog-ng.log");
};
destination D_VPN {
file("/Users/me/Logs/vpn.log");
};
destination D_VPN_FLOWS {
file("/Users/me/Logs/flows_vpn.log");
};
destination D_FIREPOWER {
file("/Users/me/Logs/FirePOWER.log");
};
#########################################################
# Source Filters
#
filter F_VPN {
( host("asa5506") or netmask(172.31.254.6/32) )
and not message("%ASA-6-3020");
};
filter F_VPN_FLOWS {
( host("asa5506") or netmask(172.31.254.6/32) )
and message("%ASA-6-3020")
and not message("UDP.*/53 duration")
and not message("duration 0:00:00 bytes 0");
};
filter F_FIREPOWER {
host("FirePOWER") or netmask(172.31.254.66/32);
};
#########################################################
# Log Paths - this is where the actual logging happens!
#
log {
source(S_LOCAL);
destination(D_SYSLOG-NG);
};
log {
source(SYSLOG_UDP);
filter(F_VPN);
destination(D_VPN);
};
log {
source(SYSLOG_UDP);
filter(F_VPN_FLOWS);
destination(D_VPN_FLOWS);
};
log {
source(SYSLOG_UDP);
filter(F_FIREPOWER);
destination(D_FIREPOWER);
};
