Enterasys Security Information and Event Manager, Configuration Manual

Page: 28 / 426

Configuring DSMs
12 A
PACHE
HTTP S
ERVER
For example,
CustomLog “|/usr/bin/logger -t httpd -p local1.info”
MyApacheLogs
Step 5
Type the following command to disabled hostname lookup:
HostnameLookups off
Step 6
Save the Apache configuration file.
Step 7
Edit the syslog configuration file.
/etc/syslog.conf
Step 8
Add the following information to your syslog configuration file:
<facility>.<priority> <TAB><TAB>@<host>
Where:
<facility>
is the syslog facility, for example, local0.
This value must match
the value you typed in
Step 4
.
<priority>
is the syslog priority, for example, info or notice.
This value must
match the value you typed in
Step 4
.
<TAB>
indicates you must press the Tab key.
<host>
is the IP address of the SIEM Console or Event Collector.
Step 9
Save the syslog configuration file.
Step 10
Type the following command to restart the syslog service:
/etc/init.d/syslog restart
Step 11
Restart Apache to complete the syslog configuration.
Step 12
You are now ready to configure the log source in SIEM.
SIEM automatically detects syslog events from an Apache HTTP Server. However,
if you want to manually configure SIEM to receive events from Apache:

From the Log Source Type drop-down list box, select Apache HTTP Server .
For more information on Apache, see http://www.apache.org/.
Configuring
Apache Using
Syslog-ng
To configure Apache using the syslog-ng protocol:
Step 1
Log in to the server hosting Apache, as the root user.
Step 2
Edit the Apache configuration file.
/etc/httpd/conf/httpd.conf
Step 3
Add the following information to the Apache configuration file to specify the
LogLevel: