Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.
Cortex AgentiX

Integrate a syslog receiver

Configure a Cortex AgentiX syslog receiver to forward logs and issues, allow regional IP addresses, and set TCP, UDP, or TLS connection settings.

A syslog receiver can be a physical or virtual server, a SaaS solution, or any service that accepts syslog messages.

To send Cortex AgentiX notifications to your syslog receiver, you first need to define the settings for the syslog receiver. After this is complete, you can configure notification forwarding.

Enable access

Before you begin, enable access to the following Cortex AgentiX IP addresses for your region in your firewall.

Region
Log Forwarding address

United States - Americas (US)

35.232.87.9, 35.224.66.220

United States - Government

104.198.222.185, 35.239.59.210

Brazil (BR)

35.247.234.13, 34.39.178.116

Canada (CA)

35.203.54.204, 35.203.52.255

Region
Log Forwarding IP Addresses

France (FA)

34.163.100.253, 34.155.72.149

Germany (DE)

35.234.95.96, 35.246.192.146

Israel (IL)

34.165.194.4, 34.165.101.105

Italy (IT)

34.154.0.173, 34.154.71.94

Netherlands - Europe (EU)

34.90.202.186, 34.90.105.250

Poland (PL)

34.118.45.145, 34.118.126.170

Qatar (QT)

34.18.48.182, 34.18.43.40

Saudi Arabia (SA)

34.166.50.215, 34.166.55.72

South Africa (ZA)

34.35.70.253, 34.35.10.167

Spain (ES)

34.175.83.90, 34.175.230.150

Switzerland (CH)

34.65.228.95, 34.65.74.83

United Kingdom (UK)

34.105.227.105, 34.105.149.197

Region
Log Forwarding IP Addresses

Australia (AU)

35.189.38.167, 34.87.219.39

Delhi (DL)

34.126.223.198, 34.131.110.15

India (IN)

34.93.247.41, 34.93.183.131

Indonesia (ID)

34.101.248.99, 34.101.176.232

Japan (JP)

34.84.88.183, 35.243.76.189

Singapore (SG)

35.240.192.37, 34.87.125.227

South Korea (KR)

34.64.198.58, 34.47.86.20

Taiwan (TW)

35.234.2.208, 35.185.171.91

How to send issues or logs to a syslog receiver

  1. Go to Settings → Configurations → Integrations → External Applications → Add Application and select Syslog.

  2. Define the following parameters:

    Parameter
    Description

    Name

    Unique name for the server profile.

    Destination

    IP address or fully qualified domain name (FQDN) of the syslog receiver.

    Port

    Port number to send syslog messages.

    Facility

    Select one of the syslog standard values. The value maps to how your syslog server uses the facility field to manage messages. For details on the facility field, see RFC 5424.

    Protocol

    Method of communication with the syslog receiver:

    • TCP: No validation is made on the connection with the syslog receiver. However, if an error occurred with the domain used to make the connection, the Test connection will fail.

    • UDP: No error checking, error correction, or acknowledgment. No validation is done for the connection or when sending data.

    • TCP + SSL: Cortex AgentiX validates the syslog receiver certificate and uses the certificate signature and public key to encrypt the data sent over the connection.

    Certificate

    The communication between Cortex AgentiX and the syslog destination can use TLS. In this case, upon connection, Cortex AgentiX validates that the syslog receiver has a certificate signed by either a trusted root CA or a self-signed certificate. You may need to merge the Root and Intermediate certificate if you receive a certificate error when using a public certificate.

    If your syslog receiver uses a self-signed CA, upload your self-signed syslog receiver CA. If you only use a trusted root CA leave the certificate field empty.

    • Up to TLS 1.3 is supported.

    • Verify the self-signed CA includes your public key.

    You can ignore certificate errors. For security reasons, this is not recommended. If you choose this option, data and logs will be forwarded even if the certificate contains errors.

  3. Test the parameters to ensure a valid connection, and click Connect when ready.

    You can define up to five syslog receivers. Upon success, the table displays the syslog servers and their status.

After you integrate with your syslog receiver, configure your forwarding settings. For more information, see Configure notification forwarding.

Syslog receiver test message errors

When configuring a syslog message, Cortex AgentiX sends a test message. If a test message cannot be sent, Cortex AgentiX displays an error message to help you troubleshoot.

The following table includes descriptions and suggested solutions for the error messages:

Host Resolving Failed

Description

The IP address or hostname you provided doesn't exist, or can't be resolved.

Suggested Solution

Ensure you have the correct IP address or the hostname.

Configured Local Address

Description

The IP address or hostname you provided is internal and can't be used.

Suggested Solution

Ensure you have the correct IP address or the hostname.

Wrong Certificate Format

Description

The certificate you uploaded is in an unexpected format and can't be used. The certificate must be an ASCII string or a bytes-like object.

Suggested Solution

Re-create the certificate in the correct format, for example:

-----BEGIN CERTIFICATE-----MIIDHTCCAgWgAwIBAgIQSwieRyGdh6BNRQyp406bnTANBgkqhkiG9w0BAQsFADAhMR8wHQYDVQQDExZTVVJTLUNoYXJsaWVBbHBoYS1Sb290MB4XDTIwMDQzMDE4MjEzNFoXDTMwMDQzMDE4MzEzNFowITEfMB0GA1UEAxMWU1VSUy1DaGFybGllQWxwaGEtUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJHH2HR/CzVzm9lOIu6rrtF9opYeIJdtgJR2Le7w4M56lFKIoziAfZD9qR0DqXpAV+42PZC8Oe4ueweD44OKTnaofbOxQvygelvHkFyAj+oz0VppzhmeUXh1Eux96QKB+Q+vSm8FbNlBL2SI8RhceYsWtZe5vBm/zDdV2alO5LJ3rEj9ycG1a7re1wSDQ67NaSrny+C/7IL5utlVspcgjslEiGM7D30uKszpq3CCeV9f7aPHCVZbbFRBxe4cbgZjGvE7Mm1OBbsypMT3z8jmSj7Kz5ui6R8mlqtll5MkIGtvmc1aypJHKrobwcs2ozEmLiVR0F1oJrl+PIZy5MXhBUcCAwEAAaNRME8wCwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFIJ1ZhG0dkgwF8OOB/eT4u/9yowaMBAGCSsGAQQBgjcVAQQDAgEAMA0GCSqGSIb3DQEBCwUAA4IBAQBvDQ4Epr0zxQHuyziDtlauddVsrLpckljHc+dCIhBvGMzGEj47Cb0c/eNt6tHrPThyzRxOHd9GBMX4AxLccPNuCZdWIRTgb4SYzDspGEYDK7v/N5+FvpYdWRgB4msUXhHt36ivH450XuY8Slt+qbQWNVU2+xIkMSSA3mUwnK+hz1GwO/Zc2JYOaVZUrW39EuzNePJ+O6BlgMRMRPNGzgT+xSxt316r/QnVA2sk4IXshdGGMG0VcuzBCyeuiCRP5/2QeFthas5EoXbdlB5eK3VzqLtiKyua/kS/hPuKahN9mI8FZ4TNB+nd6+eRQs2nsnbVOFmmOYu5KkGnDOjTzRh4-----END CERTIFICATE-----

Connection Timed Out

Description

Cortex AgentiX didn’t connect to the syslog receiver in the expected time. This could be because your firewall blocked the connection or because the configuration of the syslog server caused it to drop the connection.

Suggested Solution

Check the firewall logs and the connection using Wireshark.

Connection Refused

Description

The syslog receiver refused the connection. This could be because your firewall blocked the connection or because the configuration of the syslog server caused it to drop the connection.

Suggested Solution

Check the firewall logs and the connection using Wireshark.

Connection Reset

Description

The connection was reset by the syslog receiver. This could be because your firewall blocked the connection or because the configuration of the syslog server caused it to drop the connection.

Suggested Solution

Check the firewall logs and the connection using Wireshark.

Certificate Verification Failed

Description

The uploaded certificate couldn’t be verified for one of the following reasons.

  • The certificate doesn't correspond to the certificate on the syslog receiver and cannot be validated.

  • The certificate doesn’t have the correct hostname.

  • You are using a certificate chain and didn’t merge the certificates into one certificate.

Suggested Solution

  • Incorrect certificate: to check that the certificate you are uploading corresponds to the server syslog certificate, use the following openssl command.

    openssl verify -verbose -CAfile cortex_upload_certificate syslog_certificate

    If the certificate is correct, the result is syslog_certificate: OK.

  • Incorrect hostname: make sure that the hostname/ip in the certificate matches the syslog server.

  • Certificate chain: If you are using a list of certificates, merge the chain into one certificate. You can concatenate the certificates using the following cat command in Linux or macOS.

    cat intermediate_cert root_cert > merged_syslog.crt

    If the concatenated certificate doesn’t work, change the order of the root and intermediate certificates, and try again.

    To verify that the chain certificate was saved correctly, use the following OpenSSL command.

    openssl verify -verbose -CAfile cortex_upload_certificate syslog_certificate

    If the certificate is correct, the result is syslog_certificate: OK.

Connection Terminated Abruptly

Description

The firewall or the syslog receiver dropped the connection unexpectedly. This could be because the firewall on the customer side limits the number of connections, the configuration on the syslog receiver drops the connection, or the network is unstable.

Suggested Solution

Check the firewall logs and the connection using Wireshark.

Host Unreachable

Description

The network configuration is faulty, and the connection can't reach the syslog receiver.

Suggested Solution

Check the network configuration to make sure everything is configured correctly, like a firewall or a load balancer which may be accidentally directing the connection to a dead server.

SSL Error

Description

Unknown SSL error.

Suggested Solution

To investigate the issue, contact support.

Connection Unavailable

Description

General error.

Suggested Solution

To investigate the issue, contact support.

PreviousForward notifications to webhook
NextIntegrate Slack for outbound notifications

Last updated

Was this helpful?