Enterasys Security Information and Event Manager, Configuration Manual

Page: 278 / 426

Configuring DSMs
262 N
OVELL E
D
IRECTORY
log4j.appender.S=org.apache.log4j.net.SyslogAppender
Step 5
To configure the IP address for the syslog destination, remove the comment
marker (#) and edit the following lines:
log4j.appender.S.Host=<IP address>
log4j.appender.S.Port=<Port>
Where,
<IP address>
is the IP address or hostname of SIEM.
<Port>
is the port number for the UDP or TCP protocol. The default port for syslog
communication is port 514 for SIEM or Event Collectors.
Step 6
To configure the syslog protocol, remove the comment marker (#) and type the
protocol (UDP, TCP, or SSL) use in the following line:
log4j.appender.S.Protocol=TCP
The encrypted protocol SSL is not supported by SIEM.
Step 7
To set the severity level for logging events, remove the comment marker (#) from
the following line:
log4j.appender.S.Threshold=INFO
The default value of INFO is the correct severity level for events.
Step 8
To set the facility for logging events, remove the comment marker (#) from the
following line:
log4j.appender.S.Facility=USER
The default value of USER is the correct facility value for events.
Step 9
To set the facility for logging events, remove the comment marker (#) from the
following line:
log4j.appender.R.MaxBackupIndex=10
Step 10
Save the xdas.properties file.
Once you have configured the syslog properties for XDASv2 events, you are ready
to load the XDASv2 modules.
Loading the XDASv2
Module
Before you can configure events in Novell iManager, you must load the changes
you made to the XDASv2 module. To load the XDASv2 module, select your
operating system.
•
To load the XDASv2 in Linux, see Loading the XDASv2 on a Linux Operating
System .
•
To load the XDASv2 in Windows, see Loading the XDASv2 on a Windows
Operating System .
NOTE
If your Novell eDirectory has Novell Module Authentication Service (NMAS)
installed with NMAS auditing enabled, the changes made to XDASv2 modules are
loaded automatically. If you have NMAS installed, you should configure event