Overview-
We will do the configuration on CLI for the Syslog forwarding to the CCE. We can see the logs in /var/log/messages just fine.
Steps to Configure -
We would configure /etc/rsyslog.d/vyatta-log.conf as *.* @remotesysloghost and all work just fine.
Below is the prefered link -
Sending firewall logs to remote syslog | Ubiquiti Community
Verification of configuration
Verification can be done in 2 ways either on CCE or on UI
VERIFICATION THROUGH UI
1.Open UI >>Systems
Dropdown systems and go inside -
logs and flows collection status.
Under -
Source device IP address section the device configured will reflect.
Verification Through CCE server
sudo tcpdump -i any host 9995 and host <IP address> -AAA” command should be ran on CCE server to check wheather or not we are getting logs .