3

I have several www servers in DMZ. My monitoring and log gathering server lays in my LAN. There is no comunication like
WWW server in DMZ ----> monitor server in LAN.

I can connect DMZ from my LAN

LAN --via proxy--> WWW server in DMZ.

I'm going to use syslog-ng. Problem is that syslog-ng work in client-server architecture and clients connect to server to send logs.

Is there a way to configure syslog-ng in some type passive mode that server (in my LAN) will connect to clients(DMZ) and collect logs?

EDIT: I was reading about Zabbix proxy (zabbix can monitor logs) ... And teoreticaly relying on zabbix docs it will be posible to make my scenario work. Anybody can confirm that?

2
  • Is there any other host in the DMZ that can connect to monitor server?
    – quanta
    Dec 6, 2011 at 9:58
  • no there isn't, LAN is not accessible from outside
    – B14D3
    Dec 6, 2011 at 10:21

3 Answers 3

2

What about tunneling, i.e. using Stunnel? For every DMZ server to be monitored:

  1. Let the logserver start a tunnel to the DMZ server
  2. Configure the DMZ server's syslog so that it connects to the tunnel and use it as additional destination

Note: this may work through firewall/NAT (as per your title) but not through proxy (as per your question content).

1

I don't know about syslog-ng, but I know that Splunk can be configured to collect and index log files from client systems periodically. Otherwise, the best I think you would be able to do is to setup a cron job on your log server to rsync the files to something like /var/log/clientN/*.log, and manually call logrotate on the client.

1
  • im looking for ready-made solution, i want avoid making logging system from scratch (rsync, email etc..)
    – B14D3
    Dec 14, 2011 at 8:40
1

This might not help, but I'll share how we get around this. Essentially we use multiple DMZs.

  • DMZ1 contains Internet-facing hosts and cannot talk back to the inside LAN.
  • DMZ2 is a segregated area (on the same firewall, different VLAN) that can talk to hosts in DMZ1 (both ways) but not the Internet. Some hosts in DMZ2 can also talk to certain hosts on the inside LAN.

Therefore hosts in DMZ1 that need to syslog centrally/scp files/send email reports do so via a management host in DMZ2. The information on the management host can then be picked up by a host on the inside.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .