Syslog Port Customization | Voters

Syslog Port Customization

in progress

Clay Eden

I think it would be great if we have the ability to specify / override the default syslog port (514). In environments with multiple syslog servers running on a device, it would great to be able to allow Huntress to consume syslogs without disrupting existing services.

Thanks

June 13, 2024

Chris Bisnett

marked this post as

in progress

We've started the updates to the Huntress Agent and Portal to allow the Syslog port to be customized for each Syslog data source when it's created. This way the Huntress Agent can listen for Syslog data on UDP ports other than 514. This is useful if you have multiple Syslog listeners on the same machine.

This work will take us a few weeks to get rolled out to everyone and have all the agents updated.

Jacob McKean

Ninja RMM uses the same port, and it can't be changed on their end either. Currently it means I can't have Ninja installed on any machine that I need to collect SIEM logs.

Jonathan Bullock

It would be appreciated to also know that this port is already in use on a machine before deploying the collector or getting a warning.

Brian Ventura

Our RMM probe agents collect Syslog events on UDP-514, and we would prefer to leverage the same agent/endpoint for both the RMM probe and Huntress Syslog collector, so this would be very beneficial for everyone with an RMM that also collects Syslogs.

Chris Bisnett

marked this post as

planned

This makes a lot of sense and is relatively easy for us to add.