Enterasys Security Information and Event Manager, Configuration Manual

Page: 267 / 426

Configuring DSMs
Nortel Secure Router 251
host <ID> facility local0
Where
<ID>
is the ID specified in Step 2 .
Step 5
Enable the host:
host enable
Step 6
Type the severity level for which syslog messages are sent:
host <ID> severity info
Where
<ID>
is the ID specified in Step 2 .
Step 7
Enable the ability to send syslog messages:
state enable
Step 8
Verify the syslog configuration for the host:
sylog host <ID> info
For example, the output may resemble the following:
ERS-8606:5/config/sys/syslog/host/1# info
Sub-Context:
Current Context:
address : 10.10.10.1
create : 1
delete : N/A
facility : local6
host : enable
mapinfo : info
mapwarning : warning
maperror : error
mapfatal : emergency
severity : info|warning|error|fatal
udp-port : 514
ERS-8606:5/config/sys/syslog/host/1#
Step 9
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Nortel ERS 8300/8600 device:

From the Log Source Type drop-down list box, you must select the Nortel
Ethernet Routing Switch 8300/8600 option.
For more information on configuring log sources, see the Log Sources User Guide .
For more information about the Nortel ERS 8300/8600, see
http://www.nortel.com/support.
Nortel Secure
Router
A SIEM Nortel Secure Router DSM accepts events using syslog. SIEM records all
relevant events. Before configuring a Nortel Secure Router device in SIEM, you
must configure your device to send syslog events to SIEM.