Enterasys Security Information and Event Manager, Configuration Manual

Page: 266 / 426

Configuring DSMs
250 N
ORTEL
N
ETWORKS
config term
Step 3
Type
informational
as the severity level for the logs you wish to send to the
remote server:
logging remote level {critical|informational|serious|none}
Where
informational
sends all logs to the syslog server.
Step 4
Enable the host:
host enable
Step 5
Type the remote logging address:
logging remote address <IP address>
Where
<IP address>
is the IP address of the SIEM system.
Step 6
Ensure that remote logging is enabled:
logging remote enable
Step 7
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Nortel ERS 2500/4500/5500 device:

From the Log Source Type drop-down list box, select the Nortel Ethernet
Routing Switch 2500/4500/5500 option.
For more information on configuring log sources, see the Log Sources User Guide .
For more information about the Nortel ERS 2500/4500/5500, see
http://www.nortel.com/support.
Nortel Ethernet
Routing Switch
8300/8600
A SIEM Nortel Ethernet Routing Switch (ERS) 8300/8600 DSM accepts events
using syslog. SIEM records all relevant events. Before configuring a Nortel ERS
8600 device in SIEM, you must configure your device to send syslog events to
SIEM.
To configure the device to send syslog events to SIEM:
Step 1
Log in to the Nortel ERS 8300/8600 command line interface (CLI).
Step 2
Type the following command:
config sys syslog host <ID>
Where
<ID>
is the ID of the host you wish to configure to send syslog events to
SIEM.
For the syslog host ID, the valid range is 1 to 10.
Step 3
Type the IP address of your SIEM system:
address <IP address>
Where
<IP address>
is the IP address of your SIEM system.
Step 4
Type the facility for accessing the syslog host.