Set up network syslog monitoring

We recommend using a Docker container to deploy the agent for syslog message collection. To use it, you need:

• Docker installed in a Linux host
• Ability to launch new containers via command line

If you're using Linux to install the agent as a service, you need:

• SSH access to the host
• Access to install/remove applications and services
• One of these supported operating systems:
  • CentOS 7
  • CentOS 8
  • Debian 12 (Bookworm)
  • Debian 11 (Bullseye)
  • Debian 10 (Buster)
  • RedHat Enterprise Linux 9
  • Ubuntu 20.04 (Focal LTS)
  • Ubuntu 22.04 (Jammy LTS)
  • Ubuntu 23.04 (Lunar)

• Source devices must be configured to send syslog messages to the host running the network monitoring agent. Here's how to configure network syslog export in some devices (this is not an all-inclusive list):
  • Checkpoint - Security Gateway. You must sign in to the User Center/PartnerMAP checkpoint.
  • Cisco - ASA
  • Cisco - IOS
  • Cisco - NX-OS
  • F5 - BIG-IP
  • Fortinet Fortigate
  • Juniper - Junos
  • Palo Alto - PAN-OS

Check the network security prerequisites for network syslog.

1. Go to one.newrelic.com > All capabilities > Add more data.
2. Scroll down until you see Network and click Syslog.
3. Follow the steps outlined in the guided installation process. You can use Docker or Linux.

4. Investigate your device syslog messages in the New Relic log management UI, using the following query:

   "plugin.type":"ktranslate-syslog"

   Copy

   Here's a short video (2:56 minutes) showing how to set up network syslog monitoring:

If you follow this manual installation process, support may be unable to assist you if issues arise. If you still wish to proceed, do the following:

1. On a Linux host with Docker installed, download the ktranslate image by running one of the following:

• Docker Hub
  bash

  Copy

  $
  docker pull kentik/ktranslate:v2

• Quay.io
  bash

  Copy

  $
  docker pull quay.io/kentik/ktranslate:v2

2. Copy the snmp-base.yaml file to the local $HOME directory of your Docker user, and discard the container by running

   bash

   Copy

   $
   cd .
   $
   id=$(docker create kentik/ktranslate:v2)
   $
   docker cp $id:/etc/ktranslate/snmp-base.yaml .
   $
   docker rm -v $id

3. Edit the snmp-base.yaml file, and add your network syslog devices inside the devices dictionary key with the following structure:

   devices:
     # This key and the corresponding 'device_name'
     # need to be unique for each device
     edge_router:
       device_name: edge_router
       device_ip: 10.10.1.254
       ping_only: true
       # Optional user tags
       user_tags:
         owning_team: net_eng
         environment: production

   Copy

   Important

   If you're already monitoring SNMP data devices that will also send network syslog, you'll want to ensure that the value for device_name is identical for both configuration files to ensure the syslog messages are attributed to the right entity in the New Relic UI.

4. Run ktranslate to listen for network syslog messages by running:

   bash

   Copy

   $
   docker run -d --name ktranslate-syslog --restart unless-stopped --pull=always -p 162:1620/udp \
   >
   -v `pwd`/snmp-base.yaml:/snmp-base.yaml \
   >
   # Replace with your license key
   >
   -e NEW_RELIC_API_KEY=$YOUR_NR_LICENSE_KEY \
   >
   kentik/ktranslate:v2 \
   >
     -snmp /snmp-base.yaml \
   >
     # Replace with your account ID
   >
     -nr_account_id=$YOUR_NR_ACCOUNT_ID \
   >
     # If your organization is located in Europe, add the following flag:
   $
     # -nr_region=EU \
   $
     # If you want to use FedRAMP, add the following flag to use the FedRAMP authorized endpoints:
   $
     # -nr_region=GOV \
   $
     -metrics=jchf \
   >
     -tee_logs=true \
   >
     # Use this field to create a unique value for `tags.container_service` inside of New Relic
   >
     -service_name=$UNIQUE_NAME \
   >
     # Optional: To override the default listening port of "0.0.0.0:5143":
   $
     # -syslog.source="<ip_address>:<port>" \
   $
     # Optional: To set a custom DNS server for IP resolution
   $
     # -dns="$DNS_SERVER" \
   $
     nr1.syslog

5. Investigate your device syslog messages in the New Relic log management UI, using the following query:

   "plugin.type":"ktranslate-syslog"

   Copy