SonicWall NGFW
SonicWall next-generation firewalls run SonicOS and are common in small and mid-sized deployments, typically serving as both the perimeter firewall and the remote-access gateway. Their syslog output is a stream of name-value pairs covering connection open and close events with byte counts, intrusion-prevention and gateway-antivirus verdicts, content filtering decisions, administrative logins and configuration changes. The SSL-VPN component logs separately and is worth treating as its own feed: remote-access authentication successes and failures are among the highest-value records the appliance produces.
Device-side setup
Configure the device to forward syslog to the listener described below, following the vendor's own documentation for its syslog export. Nothing has to be built on the platform side beyond installing the template below: it supplies the parser and wires the pipeline.
Syslog configuration
The appliance sends to a syslog listener: either the cloud syslog endpoint or a local collector appliance. The two destinations use different ports. The cloud endpoint has a per-tenant domain and a block of ports allocated to your account: Configuration → Syslog Ports (v1: Platform → Administration → Syslog Ports) shows the domain, the port range, and which protocol listens on which port; read the numbers off that page rather than assuming a standard one. A collector appliance listens on UDP/514 and TCP/514 by default; a TLS listener (usually 6514 for TLS, 7514 for TLS RFC 6587) is one you add on its Syslog Ports tab and open in the collector's firewall, and each of its listeners can carry a Customer Tag that attributes the records arriving on it. See Syslog Import for the protocol options and Syslog Ports for the listener configuration.
The shipped parser (fpl-SonicWallFWSyslog) requires the structured name-value format SonicOS sends by default: records beginning sn= with an id= field. It is not free-form text. Switching the appliance to CEF or WebTrends stops it parsing; Enhanced Syslog is fine.
Install the Application
- v2 interface
- Classic v1 interface
In the navigation rail, open Applications and click Install Application, then choose SonicWall NGFW Syslog from the On-Premise IT category of the Application Catalog.
Go to Platform → Applications → Install Application From Template and choose SonicWall NGFW Syslog from the On-Premise IT category.
The template supplies the parser and builds the pipeline: there is no source to add, no processor to attach, and no sink to wire by hand. Both parameters are required:
| Parameter | Notes |
|---|---|
| datalake | Pre-filled managed. |
| datalake index name | Pre-filled SonicWall. Two applications writing to the same index name in the same lake will collide, and the second one aborts. |
- v2 interface
- Classic v1 interface
Both sit in the collapsed Advanced configuration section (the form has no Configuration section), so click its heading to reach them. The defaults are usually right; change the index name when something else on the platform already writes to SonicWall.
Click Install Application. The Applications page opens with the notice Default is launching., and the new application is listed with a green Running badge once the pipeline is up.
Both sit in the collapsed Advanced Configurations row below the Parameters heading, which is otherwise empty; expand the row to reach them. The defaults are usually right; change the index name when something else on the platform already writes to SonicWall.
Press Install. The application then appears in the Installed Applications view, where its badge reads Running once the pipeline is up.
Related
- On-Prem / Syslog: other syslog devices.
- Sonicwall Firewall parser: the FPL parser cookbook for firewall and traffic logs. The template ships a parser already, so this is only needed if you want to customise the parsing.
- Sonicwall VPN parser: the FPL parser cookbook for SSL-VPN records, likewise for customisation.
- Syslog Import and Syslog Ports: the transport and listener.
- Time Adjustment: a recipe for correcting device timestamps sent in local time.