Turn your Cisco PIX Syslog files into Graphs using Syslog Junction.

I was setting up a bunch of monitoring at work as we hadn’t have that much implemented. I ran into this application in a random fashion. Sys Junction is an application that graphs out syslog data from Cisco PIX firewalls.

I was setting up a bunch of monitoring at work as we hadn’t have that much implemented. I ran into this application in a random fashion. Sys Junction is an application that graphs out syslog data from Cisco PIX firewalls.

The setup is simple, you download the install archive, extract it and then run the install script “run.sh”. You will need to make sure that the file has executable permissions, since my install was a linux install (they also have a windows version). Run “chmod u+x run.sh” beforehand. You would think that from reading the documentation the install would occur, but no install actually occurs. Once you type “run.sh” the application forks into the background and starts printing random logging information on your terminal. It doesn’t even install as a service, you have to do this yourself.

Now that you have Syslog Junction running, you can open up your web browser and point it to “http://127.0.0.1:11052” or the IP address of the server you have it running on. You should see a login screen, enter in the default login information which is “admin/letmein”. And bam you either see graphs or no graphs!

I didn’t have graphs! I look back now and think, should have spent 3 hours on trying to get this to finally work or not? Was it worth all the trouble of trying to figure out the problem instead of having a Install Document or any type of information other than a couple pages of a PDF file with only a couple pages of information.

After look at the logs in the folder “logs”, I see in the file “SLJunction.log”. So I decide to tail it to see whats in it. And Viola! I get an error message

2007-11-20 16:12:29,640 ERROR sljunction.SLJunctionApp - Unable to start Syslog server. Address already in use

So I ponder to myself and do what anybody in my position would do, start grinding out the debugging tools. So I run netstat:


[[email protected]:/var/www/default/SLJunction/logs]# netstat -nlp | grep syslog
udp 110400 0 0.0.0.0:514 0.0.0.0:* 4646/syslogd

Oh and look syslog had the -r option for remote machine logging. So I disabled syslog and start Syslog Junction again and no more error. But instead of getting pretty graphs, I get blank ones again.

After further testing it look as though you have to make sure that your Cisco PIX is sending only Informational syslog data otherwise it pick up the traffic.

All in all, a good application, but time consuming!

Visit the Syslog Junction site.


Did you like this article?


0 Shares:
You May Also Like

Nokia N810 gets official

The new N810 by Nokia was announced this morning, the following is some of its features as well as a picture of its pull and slide qwerty keyboard. A much bigger phone, but with a screen this size and a faster processor and more ram this phone is definitely going to be on a few peoples wish list.
Read More

Microsoft changes mind, agrees to fix IE’s URI handler

Microsoft agrees to release a patch to fix some of the security issues but not all in Internet Explorers URI Handler. I don't understand why Microsoft has such a lazy stance on security, I want to use Internet Explorer just as securely as any other browser. One mis-typed url after a fresh install of Windows could cause malicious software to gain entry to me desktop.
Read More

MySQL and OpenSSL Replication what a mess!

Just a heads up, if you do decide to enable OpenSSL so you can do encrypted MySQL replication. There are two bugs that will affect replication and the mysqldump command. They're as follows: Bug #24148 regression tests hang with SSL enabled http://bugs.mysql.com/bug.php?id=24148 http://lists.mysql.com/commits/17286 Bug #27669 mysqldump: Got error: 2026: SSL connection error when trying to connect http://bugs.mysql.com/bug.php?id=27669 http://lists.mysql.com/commits/24329 This may cause lots of problems with MySQL and SSL Replication using OpenSSL. Cheers!
Read More

Sun Microsystems Acquires MySQL

I woke up to a very big announcement today. I was browsing digg and found that MySQL was acquired by Sun Microsystems. You can read more about the acquisition on the MySQL blog of Kaj Arno about the acquisition of MySQL by Sun Microsystems. My take, with Sun releasing Solaris into the Open Source realm, this is just another piece of software that they can put under their belt and package with Solaris. I have included some blurbs from Kaj Arno's blog below.
Read More