Enterasys Security Information and Event Manager, Configuration Manual

Page: 205 / 426

Configuring DSMs
38 L
INUX
This section provides information on the following DSMs:
• Linux DHCP
•
Linux IPtables
•
Linux OS
Linux DHCP
A SIEM Linux DHCP Server DSM accepts DHCP events using syslog. SIEM
records all relevant events from a Linux DHCP Server. Before you configure SIEM
to integrate with a Linux DHCP Server, you must configure syslog within the
server.
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from your Linux DHCP Server:

From the Log Source Type drop-down list box, select Linux DHCP Server .
For more information on configuring devices, see the Log Sources User Guide .
For more information on configuring your Linux DHCP Server, consult the man
pages or associated documentation for your DHCP daemon.
Linux IPtables
A SIEM Linux IPtables DSM accepts events using syslog. SIEM records all
relevant Accept, Drop, or Reject events.
Before you configure SIEM to integrate with IPtables, you must:
Step 1
Open the
iptables.conf
file.
NOTE
The file containing IP tables rules varies according to the Linux operating system.
For a system operating Red Hat Enterprise, the file is located in the
/etc/sysconfig/iptables directory. Consult your Linux operating system
documentation for more information on configuring IP tables.
Step 2
Review the file to determine the IP tables rules you want to log.
For example, if you want to log the rule defined by the entry: