FireFlow syslog messages

FireFlow automatically sends Syslog messages for all history items, including changes made to change requests, comments, and replies, as well as for each status update in a FireFlow change request.

No additional configuration is required to save FireFlow Syslog messages locally.

FireFlow syslog message syntax

FireFlow automatically writes messages to the local syslog daemon using the local0 ID.

These messages are located in the /var/log/messages directory, which requires root permissions to access.

All FireFlow syslog messages start with a standard syslog prefix, including the event date and time, and the FireFlow machine name.

This prefix is followed by a CEF standard bar-delimited message, using the following syntax:

where:

• DeviceVendor is always set to AlgoSec.

• DeviceProduct is always set to FireFlow.

• DeviceVersion. Indicates the FireFlow version string. For example v1.1-b13.

• Name / ID. Both indicate the message type, and therefore they are the same.

• Severity. Indicates the messages severity, as a number between 0-10.

• Extension. Detailed message information in the following format:

  ticket=<ticketID> by_user=<user> msg=<message>

  Where:

  • ticketId is the change request ID.
  • user is the user or the email address of the requestor, including the FireFlow system.
  • message describes the event that triggered the message.

FireFlow syslog message examples

The following are examples of FireFlow syslog messages: