Skip to main content

​
Set up

  1. Follow the shared Log Forwarders guide to add Barracuda CloudGen Firewall and open Forwarder Details (or ask Chat for the listener ip:port)
  2. In Barracuda Firewall Admin, go to Configuration > Configuration Tree > Box > Infrastructure Services > Syslog Streaming and click Lock
  3. Under Basic Setup, set Enable Syslog Streaming to yes
  4. Under Logstream Destinations, add a destination with the IP and port from Forwarder Details. When the listener shows UDP/TCP, choose either TCP or UDP on the Barracuda destination. When it shows only one transport, use that one.
  5. Under Logdata Filters > Affected Box Logdata, add Auth-All, Config-All, Control-All, Event-All, Firewall-All and SSH-SSHd-Only. Under Affected Service Logdata, add the Firewall (firewall) and VPN-Server (vpnserver) modules.
  6. Under Logdata Streams, add a stream that sends the filter to the Wirespeed destination
  7. Click Send Changes and Activate
  8. Events will begin showing up shortly
Keep IKEv1 Log Level and IKEv2 Log Level at 0 (Configuration > Configuration Tree > Box > Assigned Services > VPN > VPN Settings > IPSec) unless troubleshooting; higher levels write very noisy debug logs.
Wirespeed parses firewall activity and audit sessions, IPS threat events, scan detections, administrator and SSH logins, VPN logins and tunnel events, directory user mappings, and box events into dedicated fields. All other box and service log lines are stored with their log file name and message.