Enterasys Security Information and Event Manager, Configuration Manual

Page: 362 / 426

Configuring DSMs
346 S
UN
S
OLARIS
vi cronfile
Step 3
Add the following information to your cronfile:
0 0 * * * /etc/security/newauditlog.sh
Step 4
Save the change to the cronfile.
Step 5
Type the following command to add the cronfile to crontab:
crontab cronfile
Step 6
You are now ready to configure the log source in SIEM to retrieve the Sun Solaris
BSM audit log files.
Pulling Data Using
the Log File Protocol
A log file protocol source allows SIEM to retrieve archived log files from a remote
host. Sun Solaris BSM supports the bulk loading of audit log files using the log file
protocol.
To configure SIEM to pull log files from Sun Solaris BSM:
Step 1
Log in to SIEM.
Step 2
Click the Admin tab.
Step 3
In the navigation menu, click Data Sources .
The Data Sources panel is displayed.
Step 4
Click the Log Sources icon.
The Log Sources window is displayed.
Step 5
From the Log Source Type drop-down list box, select Solaris BSM .
Step 6
Using the Protocol Configuration drop-down list box, select Log File .
Step 7
Configure the following parameters:
Table 66-2 Log File Parameters
Parameter Description
Log Source Identifier Type the IP address or hostname for the log source. The log
source identifier must be unique for the log source type.
Service Type From the drop-down list box, select the protocol you want to
use when retrieving log files from a remove server. The
default is SFTP.
•
SFTP - SSH File Transfer Protocol
•
FTP - File Transfer Protocol
•
SCP - Secure Copy
Note: The underlying protocol used to retrieve log files for the
SCP and SFTP service types requires that the server
specified in the Remote IP or Hostname field has the SFTP
subsystem enabled.
Remote IP or
Hostname Type the IP address or hostname of the Sun Solaris BSM
system.