Enterasys Security Information and Event Manager, Configuration Manual

Page: 277 / 426

Configuring DSMs
48 N
OVELL E
D
IRECTORY
A SIEM Novell eDirectory DSM accepts audit events from Novell eDirectory using
syslog. To use the Novell eDirectory DSM, you must have the following
components installed:
•
Novell eDirectory v8.8 with service pack 6 (sp6)
•
Novell iManager v2.7
• XDASv2
To configure Novell eDirectory with SIEM, you must:
1
Configure the XDASv2 property file to forward events to SIEM. For more
information, see
Configuring XDASv2 to Forward Events .
2
Load the XDASv2 module on your Linux or Windows Operating System. For more
information, see
Loading the XDASv2 Module .
3
Configure auditing using Novell iManager. For more information, see Configuring
Event Auditing Using Novell iManager .
4
Configure SIEM. For more information, see Configuring SIEM with Novell
eDirectory .
Configuring XDASv2
to Forward Events
By default, XDASv2 is configured to log events to a file. To forward events from
XDASv2 to SIEM, you must edit the xdasconfig.properties and configure the file for
syslog forwarding. Audit events must be forwarded by syslog to SIEM, instead of
being logged to a file.
To configure XDASv2 to forward syslog events:
Step 1
Log in to the server hosting Novell eDirectory.
Step 2
Open the following file for editing:
• Windows -
C:\Novell\NDS\xdasconfig.properties
• Linux or Solaris -
etc/opt/novell/configuration/xdasconfig.properties
Step 3
To set the root logger, remove the comment marker (#) from the following line:
log4j.rootLogger=debug, S, R
Step 4
To set the appender, remove the comment marker (#) from the following line: