Enterasys Security Information and Event Manager, Configuration Manual

Page: 31 / 426

Configuring DSMs
6 A
PPLE
M
AC
OS X
A SIEM Apple Mac OS X DSM accepts events using syslog. SIEM records all
relevant firewall, web server access, web server error, privilege escalation, and
informational events.
Before you configure SIEM to integrate with Mac OS X, you must:
Step 1
Log in to your Mac OS X device, as a root user.
Step 2
Open the
/etc/syslog.conf
file.
Step 3
Add the following line to the top of the file. Make sure all other lines remain intact:
*.*@<IP address>
Where
<IP address>
is the IP address of the SIEM system.
Step 4
Save and exit the file.
Step 5
Send a hang-up signal to the syslog daemon to make sure all changes are
enforced:
sudo killall - HUP syslogd
Step 6
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Mac OS X server:

From the Log Source Type drop-down list box, select the Mac OS X option.
For more information on configuring log sources, see the Log Sources User Guide .
For more information on Mac OS X, see your Mac OS X vendor documentation.