Enterasys Security Information and Event Manager, Configuration Manual

Page: 41 / 426

Configuring DSMs
Creating a Custom Format 25
Enabling Access
Logging
To enable access logging on your Blue Coat SG device:
Step 1
Select Configuration > Access Logging > General .
The Default Logging tab is displayed.
Step 2
Select the Enable Access Logging check box.
If the Enable Access Logging check box is not selected, logging is disabled
globally for all of the formats listed.
Step 3
Click Apply .
You are ready to configure the Blue Coat upload client. For more information, see
Configuring Blue Coat Upload Client .
Configuring Blue
Coat Upload Client
The Blue Coat upload client can forward events to SIEM using FTP or syslog.
• If you are using FTP and the Log File protocol with SIEM, see Configuring FTP
and the Log File Protocol .
• If you are using Syslog with SIEM, see Configuring Syslog in Blue Coat .
Configuring FTP and the Log File Protocol
To configure the Blue Coat upload client for FTP:
Step 1
Select Configuration > Access Logging > Logs > Upload Client .
Step 2
From the Log drop-down list box, select the log containing your custom format.
Step 3
From the Client type drop-down list box, select FTP Client .
Step 4
Click Settings .
Step 5
From the Settings For drop-down list box, select Primary FTP Server .
Step 6
Configure the following values:
a
Host - Type the IP address of the FTP server receiving the Blue Coat events.
b
Port - Type the FTP port number.
c
Path - Type a directory path for the log files.
d
Username - Type the username required to access the FTP server.
Step 7
Click OK .
Step 8
Select the Upload Schedule tab.
Step 9
From the Upload the access log option, select periodically .
Step 10
Configure the Wait time between connect attempts .
Step 11
Select if you want to upload the log file to the FTP daily or on an interval.
Step 12
Click Apply .
Step 13
You are now ready to configure the log source and protocol in SIEM: