Enterasys Security Information and Event Manager, Configuration Manual

Page: 105 / 426

Configuring DSMs
Enterasys Dragon 89
CAUTION
Do not run both syslog-ng and syslogd at the same time.
To configure syslog-ng in non-encrypted mode:
Step 1
On your EMS system, open the following file:
/opt/syslog-ng/etc/syslog-ng.conf
Step 2
Configure a Facility filter for the Syslog notification rule.
For example, if you selected facility local1:
filter filt_facility_local1 {facility(local1); };
Step 3
Configure a Level filter for the Syslog notification rule.
For example, if you selected level notice:
filter filt_level_notice {level(notice); };
Step 4
Configure a destination statement for the SIEM system.
For example, if the IP address of the SIEM system is 10.10.1.1 and you want to
use syslog port of 514, type:
destination siem { tcp("10.10.1.1" port(514)); };
Step 5
Add a log statement for the notification rule:
log {
source(s_local);
filter (filt_facility_local1); filter (filt_level_notice);
destination(siem);
};
Step 6
Save the file and restart syslog-ng.
cd /etc/rc.d
./rc.syslog-ng stop
./rc.syslog-ng start
Step 7
The Enterasys Dragon EMS configuration is complete.
Configuring syslogd Using Enterasys Dragon EMS v7.4.0 and below
If your Dragon Enterprise Management Server (EMS) is using a version earlier
than v7.4.0 on the appliance, you must use syslogd for forwarding events to a
Security and Information Manager such as SIEM.
To configure syslogd, you must:
Step 1
On the Dragon EMS system, open the following file:
/etc/syslog.conf
Step 2
Add a line to forward the facility and level you configured in the syslog notification
rule to SIEM.