Sylog no longer functioning after Session Manager upgrade

Description:

After a recent upgrade of Session Manager to release 10, our customer noticed that their syslog data from their Session Manager was no longer being received on their Syslog receiver. 

Related Articles:

Problem Clarification:

The upgraded Session Manager server was functioning correctly in other aspects with the exception of the Syslog reporting. We received no other reports of issues with the Session Manager and sm100 module routing traffic or supporting end user registrations.

Cause:

During the upgrade the new Session Manager was staged with a temporary IP address for the sm100 module, with the intention of changing the IP address during the cut over to the new server. During the cut over to the release 10 server, the underlying firewall rule in Linux was not updated correctly by the SMnetSetup script as it should have been.

Solution:

chain output {
                type filter hook output priority filter; policy drop;
                oif "lo" accept
                oif "eth1" accept
                ip6 saddr ::2 counter accept
                ct state { established, related } accept
                ip protocol icmp limit rate 4/second accept
                ip6 nexthdr ipv6-icmp limit rate 4/second accept
                oif "eth0" counter jump output_mgmt_rules
                ip saddr != 10.68.90.105 counter drop
                oif "eth0" ip saddr != 10.68.90.217 counter drop
                oif "eth0" ip daddr 10.68.16.85 udp dport 514 counter accept
        }

Replace the highlighted lines in the example with the production IP address 10.68.90.115 of the Session Manager.

chain output {
              type filter hook output priority filter; policy drop;
              oif "lo" accept
              oif "eth1" accept
              ip6 saddr ::2 counter accept
              ct state { established, related } accept
              ip protocol icmp limit rate 4/second accept
              ip6 nexthdr ipv6-icmp limit rate 4/second accept
              oif "eth0" counter jump output_mgmt_rules
                ip saddr != 10.68.90.115 counter drop
              oif "eth0" ip saddr != 10.68.90.217 counter drop
              oif "eth0" ip daddr 10.68.16.85 udp dport 514 counter accept
        }

After making this change, save the file and work with your team or customer to schedule a restart of the Session Manager.

Disclaimer: intlx Solutions Knowledge Base

The information contained in this knowledge base ("Content") is provided for informational purposes only and is intended to be a general resource. intlx Solutions does not guarantee the accuracy, completeness, or timeliness of the Content.

Use at Your Own Risk: By accessing and using the Content, you agree that you do so at your own risk. intlx Solutions assumes no responsibility for any errors or omissions in the Content, nor for any damages or losses you may suffer arising out of or related to the use of the Content.

Current Customers: If you are a current intlx Solutions customer and have questions or require further clarification on any information presented here, please do not hesitate to contact our support team directly. They are available to assist you and ensure you have the most up-to-date information specific to your needs.

Not a Customer? If you are not currently an intlx Solutions customer but are interested in learning more about our solutions and how we can help your business, please click here. We look forward to the opportunity to discuss your needs and explore how a partnership with intlx Solutions can benefit you.

Thank you for your understanding.

This article contains data that is aimed at helping fix an issue with a product. Please use this information at your own risk as intlx Solutions is not responsible for actions taken by the steps or procedures shown in these articles.