Enterasys Security Information and Event Manager, Configuration Manual

Page: 357 / 426

Configuring DSMs
66 S
UN
S
OLARIS
This section provides DSM configuration information on the following:
• Sun Solaris
•
Sun Solaris DHCP
•
Sun Solaris Sendmail
• Sun Solaris Basic Security Mode (BSM)
Sun Solaris
A SIEM Sun Solaris DSM accepts Solaris authentication events using syslog.
SIEM records all relevant events. Before you configure SIEM to integrate with a
Solaris server, you must:
Step 1
Log in to the Sun Solaris command line interface.
Step 2
Open the
/etc/syslog.conf
file.
Step 3
Forward the system’s authentication logs to SIEM by adding the following line to
the file:
*.err;auth.notice;auth.info @<IP address>
Where
<IP address>
is the IP address of the SIEM system. Use tabs instead of
spaces to format the line.
NOTE
Depending on the version of Solaris you are running, you may need to add
additional log types to the file. Contact your system administrator for more
information.
Step 4
Save and exit the file.
Step 5
Type the following command:
kill -HUP ‘cat /etc/syslog.pid‘
Step 6
You are now ready to configure the log source SIEM.
To configure SIEM to receive events from a Solaris device:

From the Log Source Type drop-down list box, select the Solaris Operating
System Authentication Messages option.
For more information on configuring log sources, see the Log Sources User Guide .