Enterasys Security Information and Event Manager, Configuration Manual

Page: 378 / 426

Step 7
Start the pbforwarder.pl script. For example:
pbforwarder.pl -h SIEM_host -t "pblog -l -t"
Step 8
Terminate the pbforwarder.pl script:
kill -QUIT `cat /var/run/pbforwarder.pl.pid`
Step 9
Reload and reconnect the pbforwarder.pl script after being truncated:
kill -HUP `cat /var/run/pbforwarder.pl.pid`
You are now ready to configure the PowerBroker within SIEM.
Step 1
From the Log Source Type drop-down list box, select Symark PowerBroker
Step 2
From the Protocol Configuration drop-down list box, select syslog to configure
the protocol.
Step 3
From the Device Hostname/IP field, type the address specified using the –H
option in Step 6 .
For more information on configuring log sources, see the Log Sources User Guide .
For more information about your Symark PowerBroker device, see your vendor
documentation.
-h The -h parameter defines the receiving syslog host (the Event
Collector host name or IP address being used to receive the logs).
-p The -p parameter defines the TCP port to be used for sending events.
If nothing is specified,
514
is used.
-H The -H parameter defines the host name or IP address for the syslog
header of all sent events. It is recommended that this be the IP
address of the Symark PowerBroker.
-r The -r parameter defines the directory name where you wish to create
the .pid file. The default is /var/run. This parameter is ignored if -D is
specified.
-l The -I parameter defines the directory name where you wish to create
the lock file. The default is /var/lock. This parameter is ignored if -D is
specified.
Table 69-1 Command Parameters (continued)
Parameters Description