Security Compliance

Barracuda Web Filter syslog events are not appearing in SEM console

If none of the syslog events from the Barracuda Web Filter are appearing in SEM, this article provides information to resolve the issue.

First published date

10/19/2018 10:32 PM

Last published date

5/28/2019 3:47 PM

Overview

None of the syslog events from your Barracuda Web Filter are appearing in Security Event Manager (formerly Log and Event Manager) (SEM).

Product section

Security Event Manager

Cause

The Barracuda Web Filter sends its syslog data to local4.log. It can't be configured to send data to a different facility. The presence of another device pointing to the same logging facility as the Barracuda triggers this issue.

The Barracuda device and Cisco ASA device connectors are set to receive and send data to local4.log by default. Since the Barracuda can't be adjusted, the other device(s) must be configured to send their syslog data to a different facility.

Resolution

Configure the Barracuda Web Filter to send its syslog data to the SEM appliance.
Verify that the Barracuda Web Filter connector is enabled under Manage > Appliances.
Reconfigure any other device sending its syslog data to local4.log (such as Cisco ASA devices) and their connectors in the SEM appliance so they point to an empty logging facility. This frees up local4.log for the Barracuda Web Filter

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.