Enterasys Security Information and Event Manager, Configuration Manual

Page: 311 / 426

Configuring DSMs
56 RSA A
UTHENTICATION
M
ANAGER
An RSA Authentication Manager DSM allows you to integrate SIEM with an RSA
Authentication Manager using syslog, or using the log file protocol. Before you
configure SIEM to integrate with RSA Authentication Manager, select your
configuration preference:
•
Configuring RSA Using Syslog
•
Configuring RSA Using the Log File Protocol
NOTE
You must apply the most recent hot fix on RSA Authentication Manager 7.1
primary, replica, node, database and radius installations before configuring
syslog.
Configuring RSA
Using Syslog
The procedure to configure your RSA Authentication Manager using syslog
depends on the operating system version for your RSA Authentication Manager or
SecureID 3.0 appliance:
• If you are using RSA Authentication Manager on Linux, see Configuring Syslog
on RSA Authentication Manager for Linux .
• If you are using RSA Authentication Manager on Windows, see Configuring
Syslog on RSA Authentication Manager for Windows .
Configuring Syslog on RSA Authentication Manager for Linux
To configure RSA Authentication Manager for syslog:
Step 1
Log in to the RSA Security Console command line interface (CLI).
Step 2
Open the following file for editing based on your operating system:
/usr/local/RSASecurity/RSAAuthenticationManager/utils/resources
/ims.properties
Step 3
Add the following enteries to the
ims.properties
file:
ims.logging.audit.admin.syslog_host = <IP address>
ims.logging.audit.admin.use_os_logger = true
ims.logging.audit.runtime.syslog_host = <IP address>
ims.logging.audit.runtime.use_os_logger = true
ims.logging.system.syslog_host = <IP address>
ims.logging.system.use_os_logger = true