Enterasys Security Information and Event Manager, Configuration Manual

Page: 106 / 426

Configuring DSMs
90 E
NTERASYS
For example, to define the local1 facility and notice level:
local1.notice @
<IP address>
Where:
<IP address>
is the IP address of the SIEM system.
Step 3
Save the file and restart syslogd.
cd /etc/rc.d
./rc.syslog stop
./rc.syslog start
Step 4
The Enterasys Dragon EMS configuration is complete.
Enterasys HiGuard
Wireless IPS
The Enterasys HiGuard Wireless IPS DSM accepts events using syslog. SIEM
records all relevant events. Before configuring the Enterasys HiGuard Wireless
IPS device in SIEM, you must configure your device to send syslog events to
SIEM.
To configure the device to send syslog events to SIEM:
Step 1
Log in to the HiGuard Wireless IPS user interface.
Step 2
In the left navigation pane, click Syslog , which allows the management server to
send events to designated syslog receivers.
The Syslog Configuration panel is displayed.
Step 3
In the System Integration Status section, enable syslog integration.
This allows the management server to send messages to the configured syslog
servers. By default, the management server enables syslog.
The Current Status field displays the status of the syslog server. The options are:
Running or Stopped. An error status is displayed if one of the following occurs:
•
One of the configured and enabled syslog servers includes a hostname that
cannot be resolved.
•
The management server is stopped.
•
An internal error has occurred. If this occurs, please contact Enterasys
Technical Support.
Step 4
From Manage Syslog Servers , click Add .
The Syslog Configuration window is displayed.
Step 5
Type values for the following parameters:
• Syslog Server (IP Address/Hostname) - Type the IP address or hostname of
the syslog server to which events should be sent.
NOTE
Configured syslog servers use the DNS names and DNS suffixes configured in
the Server initialization and Setup Wizard on the HWMH Config Shell.