Syslog, SNMP traps and NetFlow

Receive-only listeners accept syslog, SNMP traps and NetFlow. Each listener is off until an administrator turns it on. Listener sockets cannot send. Devexana blocks and records any attempt to send from a listener socket.

The three listeners

Devexana does not store SNMP community strings from traps.

Turn on a listener

Each listener is off until an administrator turns it on. By default, a listener binds to the loopback address of the appliance. To receive from devices, bind it to a LAN address. Devexana refuses a public address.

Administrator procedure:

1. Open Networking › Firewall › Logs.
2. In the view control at the top, select Logs.
3. In the Receive-only listeners panel, select Details on the listener row.
4. In Bind host, type the LAN address of the appliance.
5. In UDP port, type the port.
6. For syslog over TCP, turn on TCP framing.
7. For syslog over TCP, enter the TCP port.
8. In Source allowlist, type the address ranges that your devices send from.
9. Select Save config.
10. Set the toggle on the listener row to on.

The row shows receiving. After the first message arrives, the row shows counters for received and dropped messages. Start with logs only has the full Level 1 procedure.

Ports

The default ports are UDP 514 for syslog, UDP 162 for traps and UDP 2055 for flows. If the listener cannot use its default port, select a port above 1024. Configure your devices to send to that port. Ports and protocols lists the ports of the appliance.

Who can send

List the address ranges your devices send from. If the list is empty, the listener accepts any sender that can reach it. The row then shows accept-all-on-bind.

Devexana applies these limits to each sender:

Retention

Devexana keeps raw syslog and SNMP trap records for 30 days. Devexana keeps raw flow records for 48 hours and flow summaries for 90 days. Devexana keeps summaries of per-port observations from Barracuda CloudGen logs for 400 days. Data retention defaults lists the retention defaults.

What you can do with the data

• Networking › Firewall › Logs › Logs: filter raw lines by host name and by source address. Full-text search over raw lines is not available.
• Networking › Firewall › Logs › Flows: top talkers and time series.
• Barracuda CloudGen lines: Devexana parses them, builds daily rollups and per-port observations, and can raise alerts. See Firewall alerts and the daily brief.

Firewall processing needs a scheduled source

Devexana processes firewall logs after it reads a scheduled source. An appliance with listeners and no scheduled source produces no rollups, alerts or daily brief. Add at least one scheduled source, such as a DHCP lease file or the firewall SSH source. See Start with logs only.

Receive-only enforcement

A listener socket cannot send. If code on the appliance tries to send on a listener socket, Devexana blocks the attempt and records it. An administrator can stop every listener at once with the listener kill switch.

If a listener receives nothing, go to A listener receives nothing.