- Introduction
- Deployment
- Configuration
- OS Support
- Integration
- 42. Amazon Web Services (AWS)
- 43. Apache HTTP Server
- 44. Apache Tomcat
- 45. APC Automatic Transfer Switch
- 46. Apple macOS kernel
- 47. ArcSight Common Event Format (CEF)
- 48. Box
- 49. Brocade Switches
- 50. Browser History Logs
- 51. Check Point
- 52. Cisco ACS
- 53. Cisco ASA
- 54. Cisco FireSIGHT
- 55. Cisco IPS
- 56. Cloud Instance Metadata
- 57. Common Event Expression (CEE)
- 58. Dell EqualLogic
- 59. Dell iDRAC
- 60. Dell PowerVault MD Series
- 61. Devo
- 62. DHCP logs
- 63. DNS Monitoring
- 64. Docker
- 65. Elasticsearch and Kibana
- 66. F5 BIG-IP
- 67. File Integrity Monitoring
- 68. FreeRADIUS
- 69. Graylog
- 70. HP ProCurve
- 71. IBM QRadar SIEM
- 72. Industrial Control Systems
- 73. Linux Audit System
- 74. Linux system logs
- 75. Log Event Extended Format (LEEF)
- 76. McAfee Enterprise Security Manager (ESM)
- 77. McAfee ePolicy Orchestrator
- 78. Microsoft Active Directory Domain Controller
- 79. Microsoft Azure
- 80. Microsoft Azure Event Hubs
- 81. Microsoft Azure Sentinel
- 82. Microsoft Exchange
- 83. Microsoft IIS
- 84. Microsoft SharePoint
- 85. Microsoft SQL Server
- 86. Microsoft System Center Endpoint Protection
- 87. Microsoft System Center Configuration Manager
- 88. Microsoft System Center Operations Manager
- 89. MongoDB
- 90. Nagios Log Server
- 91. Nessus Vulnerability Scanner
- 92. NetApp
- 93. .NET application logs
- 94. Nginx
- 95. Okta
- 96. Osquery
- 97. Postfix
- 98. Promise
- 99. Rapid7 InsightIDR SIEM
- 100. RSA NetWitness
- 101. SafeNet KeySecure
- 102. Salesforce
- 103. Snare
- 104. Snort
- 105. Solarwinds Loggly
- 106. Splunk
- 107. Sumo Logic
- 108. Symantec Endpoint Protection
- 109. Synology DiskStation
- 110. Syslog
- 111. Sysmon
- 112. Ubiquiti UniFi
- 113. VMware vCenter
- 114. Windows AppLocker
- 115. Windows Command Line Auditing
- 116. Windows Event Log
- 117. Windows Firewall
- 118. Windows Group Policy
- 119. Windows Management Instrumentation (WMI)
- 120. Windows PowerShell
- 121. Microsoft Windows Update
- 122. Windows USB auditing
- 123. Zeek (formerly Bro) Network Security Monitor
- Troubleshooting
- Enterprise Edition Reference Manual
- NXLog Manager
- NXLog Add-Ons
49. Brocade Switches
Brocade switches can be configured to send Syslog messages to a remote destination, UDP port 514.
2017/03/22-23:05:12, [SEC-1203], 113962, FID 128, INFO, fcsw1, Login information: Login successful via TELNET/SSH/RSH. IP Addr: admin2
The best way to configure a Brocade switch is with the command line interface. In the case of multiple switches running in redundancy mode, each device must be configured separately.
More details on configuring Brocade switches can be found in the Brocade Document Library: search for a particular switch model and select Installation & Configuration Guides from the Filter list.
Note
|
The steps below have been tested with Brocade 4100 series switches and OS v6. Newer software versions may have additional capabilities, such as sending logs over TLS. |
-
Configure NXLog for receiving Syslog entries via UDP (see the example below), then restart NXLog.
-
Make sure the NXLog agent is accessible from the switch.
-
Log in to the switch via SSH.
-
Run the following commands. Replace
LEVEL
with an integer corresponding to the desired Syslog local facility (see the example). ReplaceIP_ADDRESS
with the address of the NXLog agent.# syslogdfacility -l LEVEL # syslogdIpAdd IP_ADDRESS
Example 236. Sending Logs With local5 FacilityThe following commands query the current Syslog facility and then set up Syslog logging to 192.168.6.143 with Syslog facility
local5
.fcsw1:admin> syslogdfacility Syslog facility: LOG_LOCAL7 fcsw1:admin> syslogdfacility -l 5 Syslog facility changed to LOG_LOCAL5 fcsw1:admin> syslogdIpAdd 192.168.6.143 Syslog IP address 192.168.6.143 added
This example shows Brocade switch logs as received and processed by NXLog.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
<Extension _syslog>
Module xm_syslog
</Extension>
<Extension _json>
Module xm_json
</Extension>
<Input in_syslog_udp>
Module im_udp
Host 0.0.0.0
Port 514
Exec parse_syslog();
</Input>
<Output file>
Module om_file
File "/var/log/brocade.log"
Exec to_json();
</Output>
{
"MessageSourceAddress": "192.168.5.15",
"EventReceivedTime": "2017-03-22 20:23:58",
"SourceModuleName": "in_syslog_udp",
"SourceModuleType": "im_udp",
"SyslogFacilityValue": 21,
"SyslogFacility": "LOCAL5",
"SyslogSeverityValue": 6,
"SyslogSeverity": "INFO",
"SeverityValue": 2,
"Severity": "INFO",
"EventTime": "2017-03-22 20:23:58",
"Hostname": "192.168.5.15",
"SourceName": "raslogd",
"Message": "2017/03/22-23:05:12, [SEC-1203], 113962, WWN 10:00:00:05:1e:02:8e:fc | FID 128, INFO, fcsw1, Login information: Login successful via TELNET/SSH/RSH. IP Addr: admin2"
}