Configuring a Syslog-NG receiver for use with ePO 5.10

Technical Articles ID: KB95594
Last Modified: 2022-08-29 04:32:04 Etc/GMT

Environment

ePolicy Orchestrator (ePO) 5.10

Problem

Syslog-NG is a free and open-source implementation of the syslog protocol for Unix and Unix-like systems.

When you configure ePO to forward events to a Syslog-NG receiver, and you click Test Connection, on the registered server page, the test is successful. But, the receiver doesn't receive any events.

The syslog-ng receiver logs the following error when an event is forwarded:

Invalid frame header; header = ''

Cause

This problem occurs if the syslog-ng's TCP port is configured to use the syslog() driver rather than the network() driver.

Solution

Open syslog-ng.conf in an editor and configure the port setting to use the network() driver.

This example configures syslog-ng to support TLS on TCP port 6514, using certificate and key files in /etc/syslog-ng/cert.d.

NOTE: In this scenario, you might need to create a self-signed certificate and key pair.

source s_network {
network (
port(6514)
transport("tls")
tls (
cert-file("/etc/syslog-ng/cert.d/syslog.crt")
key-file("/etc/syslog-ng/cert.d/syslog.key")
peer-verify(optional-untrusted)
)
);
};

Related Information

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Configuring a Syslog-NG receiver for use with ePO 5.10

Environment

Problem

Cause

Solution

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Configuring a Syslog-NG receiver for use with ePO 5.10

Environment

Problem

Cause

Solution

Related Information

Affected Products

Languages:

Choose your region

Title

Title