enable syslog

[ktroberson]

So how do I enable my security onion distro to ingest syslog message over the network. In the older version you would uncomment and restart zeek. Thanks for the help.

[cm-ops]

Run sudo so-allow and choose syslog option. https://docs.securityonion.net/en/2.3/syslog.html?highlight=syslog. To make changes within zeek see https://docs.securityonion.net/en/2.3/zeek.html?highlight=zeek.

[ktroberson]

Its not another device. In the pervious version of Sec Onion you had to enable syslog from a conf file within zeek.

[dougburks]

Please try the following:

• run sudo so-zeek-logs
• make sure that syslog is selected and press Enter
• run sudo salt-call state.apply filebeat to make the changes take effect