Enterasys Security Information and Event Manager, Configuration Manual

Page: 146 / 426

Configuring DSMs
130 IBM
Where
<IP address>
is the IP address of the SIEM system.
Step 4
Save and exit the file.
Step 5
Restart syslog:
refresh -s syslogd
For example, a typical /etc/syslog.conf file can resemble the following:
##### begin /etc/syslog.conf
mail.debug /var/adm/maillog
mail.none /var/adm/maillog
auth.notice /var/adm/authlog
lpr.debug /var/adm/lpd-errs
kern.debug /var/adm/messages
*.emerg;*.alert;*.crit;*.warning;*.err;*.notice;*.info
/var/adm/messages
auth.info@<IP address>
##### end /etc/syslog.conf
NOTE
If you are using IBM AIX v5.2 and above, you must start the AIX syslog service
using the -n option. This option prevents the syslog service from pre-pending
anything to the log message. For example, when you use the -n option, the output
resembles the following: <$PRI>$DATE $MESSAGE.
Step 6
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from an IBM AIX server:

From the Log Source Type drop-down list box, select the IBM AIX Server
option.
For more information on configuring log sources, see the Log Sources User Guide .
Configuring IBM AIX
Using the Log File
Protocol
A log file protocol source allows SIEM to retrieve archived audit log files from a
remote host. The IBM AIX DSM supports the bulk loading of log files using the log
file protocol source. When configuring your IBM DB2 to use the log file protocol,
make sure the log file protocol is reading the archived audit log.
You are now ready to configure the log source and protocol in SIEM:
Step 1
To configure SIEM to receive events from an IBM DB2, from the Log Source Type
drop-down list box, select IBM AIX Server .
Step 2
To configure the log file protocol, from the Protocol Configuration drop-down list
box, select Log File .
Step 3
We recommend that you use a secure protocol for transferring files, such as
Secure File Transfer Protocol (SFTP).