Enterasys Security Information and Event Manager, Configuration Manual

Page: 208 / 426

Configuring DSMs
192 L
INUX
For more information on syslog, see your Linux operating system documentation.
Configuring Linux OS
Using Syslog-ng
To configure Linux OS using the syslog-ng protocol:
Step 1
Log in to your Linux OS device, as a root user.
Step 2
Open the
/etc/syslog-ng/syslog-ng.conf
file.
Step 3
Add the following facility information:
filter auth_filter{ facility(authpriv); };
destination auth_destination { tcp("<IP address>" port(514)); };
log{
source(<Sourcename>);
filter(auth_filter);
destination(auth_destination);
};
Where:
<IP address>
is the IP address of the SIEM system.
<Source name>
is the name of the source defined in the configuration file.
Step 4
Save the file.
Step 5
Restart syslog-ng:
service syslog-ng restart
Step 6
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from Linux OS:

From the Log Source Type drop-down list box, select Linux OS .
For more information on configuring log sources, see the Log Sources User Guide .
For more information on syslog-ng, see your Linux operating system
documentation.