Enterasys Security Information and Event Manager, Configuration Manual

Page: 393 / 426

Configuring DSMs
74 T
ROPOS
C
ONTROL
The SIEM Tropos Control DSM accepts events using syslog, enabling SIEM to
record all fault management, login and logout events, provisioning events, and
device image upload events. Before configuring SIEM, you must configure your
Tropos Control to send syslog events to SIEM.
To configure Tropos Control to forward logs using syslog to SIEM:
Step 1
Using SSH log in to your Tropos Control device, as a root user.
Step 2
Open the following file for editing:
/opt/ControlServer/ems/conf/logging.properties
Step 3
To enable syslog, remove the comment marker (#) from the following line:
#log4j.category.syslog = INFO, syslog
Step 4
To configure the IP address for the syslog destination, edit the following line:
log4j.appender.syslog.SyslogHost = <IP address>
Where
<IP address>
is the IP address or hostname of SIEM.
By default, Tropos Control uses a facility of USER and a default log level of INFO.
These default settings are correct for syslog event collection from a Tropos Control
device.
Step 5
Save and exit the file.
Step 6
You are now ready to configure the Tropos Control DSM in SIEM.
To configure SIEM to receive events from Tropos Control:

From the Log Source Type drop-down list box, select Tropos Control .
For more information on configuring log sources, see the Log Sources User Guide .