Syslog Server Setup

Step 1: Navigate to the Security Tab

Open Backup Manager & Network Operations Suite and click on the Security tab in the left sidebar. This is where all security and monitoring features are managed, including the built-in syslog server.

The built-in syslog server allows you to collect log messages from all your network devices in one central location — essential for security monitoring, auditing, and troubleshooting.

Why use a syslog server?

• Centralised logging: All device logs arrive in one place, no need to log into each device individually
• Security visibility: Detect login failures, configuration changes, and interface flaps in real time
• Compliance: Many standards (ISO 27001, PCI-DSS) require centralised log collection and retention
• Troubleshooting: Correlate events across multiple devices to diagnose network issues faster

Step 2: Configure Syslog Server Settings

Within the Security tab, click "Syslog Server Settings" to open the configuration panel. Set the following options:

• Listening Port: Default is 514 (UDP). This is the standard syslog port — change only if your devices are configured to use a different port
• Network Interface: Choose which network adapter to listen on. If your server has multiple NICs, restrict syslog to the management interface for security
• Log Retention: Configure how many days of syslog history to keep on disk

Security recommendations:

• Bind the syslog listener to your management VLAN interface only, not your public-facing adapter
• Use a firewall rule to allow UDP 514 only from trusted device IP ranges
• Consider using TCP syslog (port 1468 or 6514 for TLS) for critical devices where log delivery must be guaranteed

Step 3: Start the Syslog Service

Once your settings are configured, click "Start Syslog Server". The status indicator will turn green to confirm the service is running and listening for incoming messages.

Verifying the service is working:

• The status badge should read Running with a green indicator
• The display shows the active listening address and port (e.g. 0.0.0.0:514)
• After configuring a network device (Step 4), log messages should begin appearing within seconds

Note: If the service fails to start, check that port 514 is not already in use by another application, and that the application has the necessary permissions to open a low-numbered port on your system.

Step 4: Configure Network Devices to Send Logs

Each network device must be configured to forward its syslog messages to the IP address of the machine running Backup Manager & Network Operations Suite. Below are commands for the most common vendors:

Cisco IOS / IOS-XE:

• logging host [SERVER_IP_ADDRESS]
• logging trap informational
• logging on

Cisco NX-OS:

• logging server [SERVER_IP_ADDRESS] 6 use-vrf management

Juniper Junos:

• set system syslog host [SERVER_IP_ADDRESS] any info

HP / Aruba:

• logging [SERVER_IP_ADDRESS]

Replace [SERVER_IP_ADDRESS] with the IP address of the computer running Backup Manager & Network Operations Suite. Use informational severity level to capture a useful level of detail without flooding the log with debug messages.

Step 5: View and Monitor Incoming Logs

Return to the Security tab to view incoming syslog messages. Messages are displayed in real time and automatically categorised by severity level.

Filtering and searching:

• By device: Filter messages from a specific IP address or hostname
• By severity: Focus on Emergency, Alert, Critical, or Error messages
• By time range: Review historical logs for a specific date and time window
• Free text search: Search for keywords such as "login failed", "interface down", or "config changed"

Severity levels (RFC 5424):

• 0 – Emergency: System is unusable
• 1 – Alert: Immediate action required
• 2 – Critical: Critical conditions
• 3 – Error: Error conditions
• 4 – Warning: Warning conditions
• 5 – Notice: Normal but significant events
• 6 – Informational: Informational messages
• 7 – Debug: Debug-level messages

Critical security events are highlighted in red for immediate attention.

Step 6: Set Up Email Alerts (Optional)

To be notified of important security events without having to monitor the screen, configure email alerts. Navigate to Settings → Email Settings and set up your SMTP details, then return to the Security tab to create alert rules.

Useful alert rules to create:

• Login failures: Alert on messages containing "authentication failed" or "login incorrect"
• Configuration changes: Alert on "%SYS-5-CONFIG_I" (Cisco) to catch unauthorised config changes
• Interface down: Alert on "line protocol is down" or "Link Down"
• High severity: Alert on any message at severity 0–3 (Emergency through Error)

How alerts work:

• Each rule defines a keyword or pattern to match against incoming syslog messages
• When a match is found, an email notification is sent immediately to your configured recipients
• Alerts include the device IP, timestamp, severity, and the full log message for context

Tip: Start with a small set of high-priority rules. Too many alerts can lead to alert fatigue — tune the rules over time based on your environment.