This article applies to:

• Firewall Suite
• AXENT Raptor Firewalls 6.0

Symptoms:

• The Vulture service keeps shutting down unauthorized services affecting the collection of firewall log file data.

Causes:

With AXENT Raptor Firewall, it can sometimes be problematic getting up-to-date reports. After installing AXENT Raptor Firewall, a service called Vulture runs, and at regular intervals, shuts down unauthorized services. This includes FTP and web servers, making it difficult to retrieve log file data automatically. rewall Suite supplies a solution to this issue, called the WebTrends Log File Forwarding Agent. This program acts as a syslog client, sending all new log data created by the AXENT Raptor Firewall to the machine on which Firewall Suite is installed. This, coupled with Firewall Suite's built in syslog server, can provide up-to-date and accurate reports. Follow the below directions for set up.

Information:

1. Copy the following file to AXENT Raptor Firewall and place it in a temporary directory. A floppy disk or other removable media may be needed to accomplish this.

   <Installation Directory>\ForwardingAgentSetup.exe

   The above file is provided with Firewall Suite, and is located in the root of the install directory as shown above.

2. Run the file, which begins the installation procedure. Follow the instructions. The current day's log file for Raptor Firewall is at the following location.

   <Raptor Install Directory>\Firewall\sg\logfile

3. Once the installation has completed, go to the following file and open it with a text editor such as Notepad. Do not use Microsoft Windows WordPad.

   <Raptor Install Directory>\Firewall\sg\vulture.runtime

4. Add the following line at the bottom:

   WTSysLog

5. Save the file.
   
6. Start the Raptor Management Console. A dialog will come up saying, "The system configuration may have been edited by hand. Would you like to restore it from a backup?" Click No. Once the Raptor Management Console is running, save the Console settings.

7. In Firewall Suite, set up a profile for AXENT Raptor Firewall using syslog as the profile's method of retrieving the log file. For the IP here, specify the IP of the AXENT Raptor Firewall. In some cases, such as when Network Address Translation is being used, the syslog traffic may have changed the IP in the packet header. In this case, fill in the appropriate IP. If unsure of what it should be, see a network administrator for assistance.

Notes:

This solution has only been tested for AXENT Raptor Firewalls 6.5 for Microsoft Windows NT. Other versions may or may not operate the same, and log file paths may be different.

This article was previously published as:

NETIQKB1620