Enterasys Security Information and Event Manager, Configuration Manual

Page: 401 / 426

Configuring DSMs
Websense V-Series Content Gateway
385
Step 6
Click the Custom tab.
Step 7
In the Custom Log File Definitions window, type the following text for the LEEF
format.
<LogFormat>
<Name = "leef"/>
<Format =
"LEEF:1.0|Websense|WCG|7.6|%<wsds>|cat=%<wc> src=%<chi> devTime=
%<cqtn> devTimeFormat=dd/MMM/yyyy:HH:mm:ss
Z http-username=%<caun> url=%<cquc>
method=%<cqhm> httpversion=%<cqhv> cachecode=%<crc> dstBytes
=%<sscl> dst=%<pqsi>
srcBytes=%<pscl> proxy-status-code=%<pssc> server-status-code=%<ss
sc> usrName=%<wui> duration=%<ttms>"/>
</LogFormat>
<LogObject>
<Format = "leef"/>
<Filename = "leef"/>
</LogObject>
NOTE
The fields in the LEEF format string are tab separated. You may need to type the
LEEF format in a text editor and then cut and paste it into your web browser to
retain the tab separations.The definitions file ignores extra white space, blank
lines, and all comments.
Step 8
Select Enabled to enable the custom logging definition.
Step 9
Click Apply .
You are now ready to enable event logging for your Websense Content Gateway.
Enabling Event Logging
If you are using a Websense V-Series appliance, you need to contact Websense
Technical Support to enable this feature.
To enable event logging on a Websense Content Gateway:
Step 1
Log in to the command line interface (CLI) of the server running Websense
Content Gateway.
Step 2
Add the following lines to the end of the /etc/rc.local file:
( while [ 1 ] ; do
tail -n1000 -F /opt/WCG/logs/leef.log | nc <IP Address> 514
sleep 1
done ) &
Where
<IP Address>
is the IP address for SIEM.
Step 3
To start logging immediately, type the following command: