Question

I am working on a project as security consultant and i need to export log file from Telonika RUT 955 and send this fiel to our SIEM solution to be monitored.

I am asking what is the best way to get all logs, and does RUT 955 support Syslog  ?

Answer 1

Hello,

  

System logs can be seen by using the command logread. If you'd like to monitor the logs in real-time, then the command logread -f can be used.

Logs can also be found by navigating to System → Administration → Troubleshoot and clicking show for the system or kernel logs.

Finally, logs alongside config files can be downloaded with a troubleshoot file, which can also be generated by navigating to System → Administration → Troubleshoot.

Let me know if none of these options suit you and I'll look for an alternative.

  

Best regards,
DaumantasG

Comments

A very convenient alternative is to forward the logs to a remote syslogd, for that enable the facility in System->Administration->Troubleshoot. Set the IP address of the remote server port protocol and enable "Show Hostname"

Logs from different devices can be separated in different files, just add

$template DynaFile,"/var/log/%HOSTNAME%.log"
*.* ?DynaFile

to the rsyslogd.conf file.