Overview
We will do the configuration on CLI for the Syslog forwarding to the CCE. We can see the logs in /var/log/messages just fine.
Steps to Configure
We would configure /etc/rsyslog.d/vyatta-log.conf as *.* @remotesysloghost and all work just fine.
Below is the prefered link -
Sending firewall logs to remote Syslog | Ubiquiti Community
Verification of configuration
Verification can be done in 2 ways either on CCE or on UI
VERIFICATION THROUGH UI
1. Open UI >>Systems
Dropdown systems and go inside -
logs and flows collection status.
Under -
The source device IP address section of the device configured will reflect.
Verification Through the CCE server
“sudo tcpdump -i any host 9995 and host <IP address> -AAA”
The above command should be run on the CCE server to check whether or not we are getting logs.