FireFlow syslog messages

FireFlow automatically sends Syslog messages for all history items, including changes made to change requests, comments, and replies, as well as for each status update in a FireFlow change request.

No additional configuration is required to save FireFlow Syslog messages locally.

In this topic:

FireFlow syslog message syntax

FireFlow automatically writes messages to the local syslog daemon using the local0 ID.

These messages are located in the /var/log/messages directory, which requires root permissions to access.

All FireFlow syslog messages start with a standard syslog prefix, including the event date and time, and the FireFlow machine name.

This prefix is followed by a CEF standard bar-delimited message, using the following syntax:

where:

• DeviceVendor is always set to AlgoSec.

• DeviceProduct is always set to FireFlow.

• DeviceVersion. Indicates the FireFlow version string. For example v1.1-b13.

• Name / ID. Both indicate the message type, and therefore they are the same.

• Severity. Indicates the messages severity, as a number between 0-10.

• Extension. Detailed message information in the following format:

  ticket=<ticketID> by_user=<user> msg=<message>

  Where:

  • ticketId is the change request ID.
  • user is the user or the email address of the requestor, including the FireFlow system.
  • message describes the event that triggered the message.

Back to top

FireFlow syslog message examples

The following are examples of FireFlow syslog messages:

Back to top