Enterasys Security Information and Event Manager, Configuration Manual

Page: 222 / 426

Configuring DSMs
206 M
C
A
FEE
Pulling Data Using the Log File Protocol
A log file protocol source allows SIEM to retrieve archived log files from a remote
host. The McAfee Web Gateway DSM supports the bulk loading of access.log files
using the log file protocol source. The default directory for the McAfee Web
Gateway access logs are
You are now ready to configure the log source and protocol in SIEM:
Step 1
To configure SIEM to receive events from a McAfee Web Gateway appliance,
select
McAfee Web Gateway from the Log Source Type drop-down list box.
Step 2
To configure the protocol, you must select the Log File option from the Protocol
Configuration drop-down list box.
Step 3
To configure the File Pattern parameter, you must type a regex string for the
access.log file, such as access[0-9]+\.log .
NOTE
If you selected to GZIP your access.log files, you must type access[0-9]+\.log\.gz
for the FIle Pattern parameter and from the Processor drop-down list box, select
GZIP .