Configuring "Remote Log" setting on IP3M-941B

[dustinl]

I have a IP3M-941B camera with the most recent firmware and have been looking at a way to capture the logs to a centralized SIEM (Splunk in my case). I see that Amcrest has an option under Information > Logs > "Remote Log" that lets me enter an IP, Port and Device Number. What I cannot find is what the "Remote Log" section actually does, and the documentation is pretty limited. From the research I've done it does not act as a Syslog setting but lets you pull logs from the camera. I'm also looking at an option to use the API but that just isn't as clean.

Any help on seeing how to configure and use the "Remote Log" option would be great. As long as I can figure out how that option works and the requirements for pulling logs via it I can get them into my SIEM.

[Revo2Maxx]

Hello and Welcome to the Forum

Sadly it is a System logger... So you would need to have a Syslog server that will take this traffic and save or export it for your needs...

I am sure there are others out there but only one that I can think of right now that is free is Kiwi from Solarwinds and I don't work for them nor do I endorse them they are only one I can think of right off my head that is free...

Anyway it listens to UDP 514 and is a dead give away that is looking for System log server...

Data looks like this

10-01-2020 21:26:48 User.Info 10.0.0.218 Oct 01 21:26:51 10.0.0.218 "EventStop"
{
"Code" : "VideoMotion",
"Index" : 1,
"RegionName" : [ "Region1" ]}

[dustinl]

That information helps. I wasn't sure if it was a System Logger or not. It had a default port of 514 but I didn't want to assume. I installed Kiwi but I'm not getting any data so I'll have to do some troubleshooting to make sure I have everything configured correctly.

Out of curiosity, do you have it setup as a Sys Logger?

[dustinl]

I feel like I may be missing something, I don't see any traffic coming from the IP of the camera on port 514 UDP. I even checked TCP just to make sure even though syslog is UDP. I'm using Kiwi from Solarwinds. I've reached out the support regarding this but they don't seem to know much about the "Remote Log" section on the camera. They keep indicating that it is for viewing the logs from a Public IP address. Hopefully I can get some answers on Monday if there is an additional setting for the Syslog to trigger.

[Revo2Maxx]

Yeah it is a pain and after seeing this it seems it is really no longer Free but a Demo from the looks of it.. I am not sure why they would Demo it unless they want people to see it isn't easy to use.. SO I DL it again and I do remember there was some issues at first when connecting it but after setting up a Trigger within Setup i could get logs However it seems if I remember right and the reason I looked else where was everytime I Rebooted my Server I had to Fish for making it work again..

So to be clear, You took your Computer you have it installed in and entered that IP address in the camera Log Server Area? Then you setup the software to listen to the PORT and IP?

I went and tried to set up the system and where I remember being able to make some adjustment for listening to my Network that option says it is turned off in the Freeware mode GRRR.. I wasn't able to get it to work..

There is another one but I can't remember what it was called at the moment that I tried after that one that was much easier to use but only gave a 30 day use and sadly the cost wasn't something I was looking to fork out.. I can just DL my logs daily seeing Amcrest has 1024 Max log size and some of my Amcrest cameras can do that in side 3/4 of a day.. To be fair most of my Cameras from all Manufactures have about same crazy log.. Only ones I can think off hand that can list and keep logs for long time is my Samsung IP cameras, However each of them I paid over a Grand for from 2011 though 2016. I have more then I care to admit to lol.. Only have 1 after they sold and to be honest it looks and feels like the older Samsung cameras..

[Revo2Maxx]

Ok so I had to go to my Cabin to figure out what I have been using there my Memory isn't to greatest these days...

The Software if I read right says it is Free for Home user now (Need to change out my Paid one then) and anyway it is Called Syslog Watcher.. You will want to install the server and watcher part and it is easy to setup..

I just DL here and while I will admit I was getting mad at first because I looked over my settings before I left the Cabin and I was sure I had it setup right.. Come to find out Kiwi was blocking it from working.. SO I Uninstalled Kiwi seeing it is POS should be FREEware fulltime as I remember having issues at first with it but always seemed to work when I used it and it was Free when I had it but now see they took out the Filters and things that I used to setup last time and if you want that in Kiwi you have to pay for it that is JUST BS to me...

Syslog Watcher install and click the Setup, Bind to your Computers IP address if you keep it a Static one like I do for mine... Then turn on your Camera and what not and it will take in Log info from the Camera..

I have it setup for a few different items on my Network and they are coming into the system without issue.. Even can do a Report that will make a Graph and tell you what type of logs it captured if then were General or Error and such this way if you missed one you can refer back and fix any thing in the error portion so that is cool...

Again It is Called Syslog Watcher and it is 1000000000% better then Kiwi In like it better then my paid logger and will start using this at home as well if in fact it is free for home users..

[dustinl]

Thanks I will check it out. I was able to get Kiwi working after reinstalling and rebooting the server and camera. Not sure what is different since it picked up my previous settings and worked. I'll take a look at the new one you mentioned as well. Thanks for the guidance.

[Revo2Maxx]

So just wanted to show you what the Report looks like. This was one of the reasons that I liked it was above what I am going to post there is a Graphic bar and pie of devices and what has what type of logs then this area will give you an idea what type of logs are being generated and let you make a Choice on what you want or need to do to fix it. SO while I did have loads of syslogs I left the Log Motion on so you could see what happens if you leave it on for the cameras.. One of the reasons some people have 1024 logs a day is because they log every Motion event and it hasn't been snowing or loads of Humid nights or that number would have been higher.. I turn off Log Motion but after setting up and wanting to show what things could look like when someone does have it set to Log Motion Events it will and can be a large number. One because there is a Start and Stop of the event..

Been meaning to get this one on this Network because I do like the format over the others that I have used.. Easy and gives good data..

Also my NVR on 222 in the logs the HDD died so yeah I had to replace a HDD in my NVR today sad..

Screenshot (38).png (180.88 KiB) Viewed 1281 times