rsyslog and kafka help

[exe]

Hello there, 

i already had an open discussion but it isnt maintained anymore. 

If you could please help us, because of sick leave we left this behind: 

https://groups.google.com/g/wazuh/c/TOhaXhteumA

Thank you!

[Diego Cappri]

Hello Exetester,

I'm checking the link you shared, will update soon.

Thanks.

Diego.

[Diego Cappri]

Hi,

I was checking the other loop and there are two root causes here:

1. Kafka .log files are binary segment files, not plain text. Wazuh can open them but cannot parse the content, so no events are generated.
2. That path lives on "spielwiese", not on "siem01" where Wazuh runs — so it's not actually reading anything useful.

The simplest fix: configure rsyslog on spielwiese to forward logs to both Kafka (for Grafana) AND directly to the Wazuh manager on siem01 via syslog. No Kafka consumer needed.

In /etc/rsyslog.conf on spielwiese, add:

if $fromhost-ip startswith '<SONICWALL_IP>' then @@<SIEM01_IP>:514
& ~

And in /var/ossec/etc/ossec.conf on siem01:

<remote>
  <connection>syslog</connection>
  <port>514</port>
  <protocol>tcp</protocol>
  <allowed-ips><SPIELWIESE_IP>/32</allowed-ips>
</remote>

Then restart the Wazuh manager: systemctl restart wazuh-manager

Let me know if that works!

[exe]

Thank you for the help,

is it possible to send the syslog logs directly from the sonicwall to the wazuh server or do i need some kind of man in the middle?