Enterasys Security Information and Event Manager, Configuration Manual

Page: 262 / 426

Configuring DSMs
246 N
ORTEL
N
ETWORKS
Step 4
Type the following command to access syslog configuration:
syslog
Step 5
Type the following commands:
log-host address <IP address>
Where
<IP address>
is the IP address of your SIEM system.
Step 6
View current default settings for your SIEM system:
info
For example:
log-host/10.11.12.210# info
address 10.11.12.210
log-facility local0
state enabled
Step 7
If the output of the command entered in Step 6 indicates that the state is not
enabled, type the following command to enable forwarding for the syslog host:
state enable
Step 8
Configure the log facility parameter:
log-facility local0
Step 9
Create a filter for the hardware slots to enable them to forward the syslog events.
Type the following command to create a filter with the name WILDCARD:
filter name WILDCARD entity all
Step 10
Configure the slot-upper bound parameter:
slot-upper bound <number of slots>
Where
<number of slots>
is the number of slots available on your device. This
parameter may require different configuration depending on your version of Nortel
Multiprotocol Router device, which determines the maximum number of slots
available on the device.
Step 11
Configure the level of syslog messages you want to send to your SIEM system:
severity-mask all
Step 12
View the current settings for this filter:
info
For example:
filter/10.11.12.210/WILDCARD# info
debug-map debug
entity all
event-lower-bound 0
event-upper-bound 255