Enterasys Security Information and Event Manager, Configuration Manual

Page: 174 / 426

Configuring DSMs
158 ISC B
IND
};
For Example:
logging {
channel SIEM {
syslog local3;
severity info;
};
category queries {
SIEM;
};
category notify {
SIEM;
};
category network {
SIEM;
};
category client {
SIEM;
};
};
Step 3
Save and exit the file.
Step 4
Edit the syslog configuration to log to your SIEM system using the facility you
selected in
Step 2 :
<syslog_facility>.* @<IP Address>
Where
<IP Address>
is the IP address of your SIEM system.
For example:
local3.* @192.16.10.10
NOTE
SIEM only parses logs with a severity level of info or higher.
Step 5
Restart the following services.
service syslog restart
service named restart
Step 6
You are now ready to configure the log source in SIEM.