SSB receives log messages from remote hosts via sources. A number of sources are available by default, but you can also create new sources. Apart from the syslog protocols, SSB can also receive messages via the SNMP protocol, and convert these messages to syslog messages.
For details on using the built-in message sources of SSB, see Default message sources in SSB.
For details on receiving SNMP messages, see Receiving SNMP messages.
For details on how to create new syslog message sources, see Creating syslog message sources in SSB.
For details on how to create new SQL message sources, see Creating SQL message sources in SSB.
SSB automatically accepts messages from the following built-in sources:
Figure 95: Log > Sources — Default message sources in SSB
legacy: Accepts UDP messages using the legacy BSD-syslog protocol on the port 514.
tcp: Accepts TCP messages using the IETF-syslog protocol (RFC 5424) on port 601.
tls: Accepts TLS-encrypted messages using the IETF-syslog protocol on port 6514. Mutual authentication is required: the client must show a (not necessarily valid) certificate, SSB sends the certificate created with the Welcome Wizard.
tcp_legacy: Accepts TCP messages using the BSD-syslog protocol (RFC 3164) on port 514.
For the details of the various settings, see Creating syslog message sources in SSB.
All default sources have name resolution enabled.
SSB can receive SNMP messages using the SNMPv2c protocol and convert these messages to syslog messages. SNMP messages are received using a special SNMP source that can be used in log paths like any other source. To configure receiving SNMP messages, complete the following steps:
Navigate to Log > Options > SNMP source.
Ensure that the SNMP source option is enabled.
Figure 96: Log > Options > SNMP source — Receiving SNMP messages
The default community of the SNMP messages is public. Modify the Community field if your hosts use a different community.
SSB can receive messages only from a single community.
To limit which hosts can send SNMP messages to SSB, create a hostlist policy, add the permitted hosts to the policy, and select the policy from the Hostlist field. For details on creating hostlists, see Creating hostlist policies.
To limit the rate of messages a host can send to SSB, enter the maximum number of packets (not messages) that SSB is allowed to accept from a single host into the Rate limit field. (This parameter sets the hashlimit parameter of the iptables packet filter that is applied to the source.)
When rate limiting is enabled, and a host sends a large number of messages, SSB processes only the amount set in the Rate limit field. Any additional messages are dropped, and most probably lost.
To use name resolution for SNMP messages, enable the Use DNS option.
To create a custom syslog message source, complete the following steps.
Navigate to Log > Sources and click .
Enter a name for the source into the top field. Use descriptive names that help you to identify the source easily.
Figure 97: Log > Sources — Creating new message sources
Select the interface of IP alias where SSB will receive the messages from the Listening address field.
Enter the port number where SSB should accept the messages (for example 1999).
If the information sent by the hosts to this source can be trusted, enable the Trusted option. SSB keeps the timestamps and the hostname of the messages sent by trusted clients. This corresponds to enabling the keep_timestamp() and keep_hostname() syslog-ng options for the source.
In the Transport field, select the networking protocol (UDP, TCP, TLS, RLTP or RLTP TLS) that your clients use to transfer the messages to SSB.
When using TCP or TLS, you can set the maximum number of parallel connections in the Maximum connections field. This option corresponds to the max_connections() syslog-ng parameter.
When using TLS, SSB displays a certificate to the client. This certificate can be set at Log > Options > TLS settings (for details, see Setting the certificates used in TLS-encrypted log transport). Optionally, SSB can perform mutual authentication and request and verify the certificate of the remote host (peer). Select the verification method to use from the Peer verification field.
None: Do not request a certificate from the remote host, and accept any certificate if the host sends one.
Optional trusted: If the remote host sends a certificate, SSB checks if it is valid (not expired) and that the Common Name of the certificate contains the domain name or the IP address of the host. If these checks fail, SSB rejects the connection. However, SSB accepts the connection if the host does not send a certificate.
Optional untrusted: Accept any certificate shown by the remote host. Note that the host must show a certificate.
Required trusted (default setting): Verify the certificate of the remote host. Only valid certificates signed by a trusted certificate authority are accepted. See Uploading external certificates to SSB for details on importing CA certificates. Note that the Common Name of the certificate must contain the domain name or the IP address of the host.
Required untrusted: SSB requests a certificate from the remote host, and rejects the connection if no certificate is received. However, SSB accepts the connection if:
the certificate is not valid (expired), or
the Common Name of the certificate does not contain the domain name or the IP address of the host.
When using TLS or RLTP TLS, configure the strength of the allowed cipher suites using one of the following options:
Weak: It is a large set of cipher suites determined by the following cipher string:
Weak setting may allow permitting (and hence not safe) cipher suites for the Transport Layer Security (TLS) negotiations.
Strong: A smaller and more strict set of cipher suites where vulnerable cryptographic algorithms are eliminated. This cipher suite set is determined by the following cipher string:
When using RLTP TLS, SSB only accepts Required-trusted peer verification.
For details on RLTP, see Reliable Log Transfer Protocol.
UDP is a highly unreliable protocol, when using UDP, a large number of messages may be lost without any warning. Use TCP, TLS or RLTP whenever possible.
In case of UDP, TCP or TLS: select the syslog protocol used by the clients from the Syslog protocol field. The RLTP and RLTP TLS sources only work with the IETF-syslog protocol.
If the clients use the legacy BSD-syslog protocol (RFC3164), select Legacy. This protocol is supported by most devices and applications capable to send syslog messages.
If the clients use the new IETF-syslog protocol (for example the clients are syslog-ng 3.0 applications that use the syslog driver, or other drivers with the flags(syslog-protocol) option), select Syslog.
In case of RLTP or RLTP TLS: enter the number of maximum connections. The default value is 1000 connections. Select Allow compression to allow compression on level 6. Compression level cannot be changed.
Set the character Encoding and Timezone options of the incoming messages if needed.
Select the Use FQDN option if you wish to store the full domain name of the sender host.
Select the name resolving method to use from the Use DNS field.
To accept messages only from selected hosts, create a hostlist and select it in the Hostlist field. For details on creating hostlists, see Creating hostlist policies.
If the messages arriving to the source do not comply to the standard syslog message format for some reason, select the Syslog flags > Do not parse messages option. This option completely disables syslog message parsing and treats the complete log line as the MESSAGE part of a syslog message. Other information (timestamp, host, and so on) is added automatically by SSB.
If you want to parse messages that comply to the standard syslog message format, but disable parsing for those that do not, select the Syslog flags > Ignore ambiguous program field option. This will prevent SSB from treating the first word of the log message as the program name in case of non-standard syslog messages and thus resulting in unexpected behavior, for example, polluting the statistics.
To configure message rate alerting for the source, see Configuring message rate alerting.
Note that in order to actually store the messages arriving to this source, you have to include this source in a log path. For details, see Log paths: routing and processing messages.
Optional step: If you want to receive messages using the RLTP or RLTP TLS protocol, make sure that you have configured your syslog-ng clients to transfer the messages to SSB using RLTP or RLTP TPS protocol. For details, see