Forwarding Syslog from Virtual Log Collector to non NetWitness destination

[Anonymous]

Hi everyone.

We have a Virtual Log Collector out in our DMZ collecting logs and receiving syslog from our firewalls.

Our new Internet proxy recommends sending syslog to a system like Graphite/Grafana for advanced usage stats. It only allows sending to a single destination.

I'd like to be able to send this syslog to both NetWitness and Grafana.

Can the Virtual Log Collector be configured to send syslog from the new proxy to a separate non NetWitness syslog destination?

Thanks.

[JesseLyon]

Hi Jeremy,

Using the process here I was able to shovel syslog from a VLC to a 3rd party destination:

https://community.rsa.com/community/products/netwitness/blog/2016/09/23/how-to-forward-syslog-from-a-remote-log-collector-to-another-destination 

It worked very well for our needs. We did have some issues with header re-writes that caused us some grief, but with some poking we were able to successfully intake syslog into both NetWitness as well as sending to a 3rd party.