Enterasys Security Information and Event Manager, Configuration Manual

Page: 27 / 426

Configuring DSMs
5 A
PACHE
HTTP S
ERVER
A SIEM Apache HTTP Server DSM accepts Apache events using syslog or
syslog-ng. SIEM records all relevant HTTP status events. The procedure in this
section applies to Apache DSMs operating on UNIX/Linux platforms only.
Select one of the following configuration methods:
•
Configuring Apache Using Syslog
• Configuring Apache Using Syslog-ng
CAUTION
Do not run both syslog and syslog-ng at the same time.
Configuring
Apache Using
Syslog
To configure Apache using the syslog protocol:
Step 1
Log in to the server hosting Apache, as the root user.
Step 2
Edit the Apache configuration file httpd.conf.
Step 3
Add the following information in the Apache configuration file to specify the custom
log format:
LogFormat "%h %A %l %u %t \"%r\" %>s %p %b" <log format name>
Where
<log format name>
is a variable name you provide to define the log
format.
Step 4
Add the following information in the Apache configuration file to specify a custom
path for the syslog events:
CustomLog “|/usr/bin/logger -t httpd -p <facility>.<priority>”
<log format name>
Where:
<facility>
is a syslog facility, for example, local0.
<priority>
is a syslog priority, for example, info or notice.
<log format name>
is a variable name you provide to define the custom log
format. The log format name must match the log format defined in Step 4 .