Enterasys Security Information and Event Manager, Configuration Manual

Page: 45 / 426

Configuring DSMs
11 B
RIDGEWATER
The SIEM Bridgewater System DSM accepts events using syslog. SIEM records
all relevant events. Before configuring a Bridgewater Systems device in SIEM, you
must configure your device to send syslog events to SIEM.
To configure the device to send syslog events to SIEM:
Step 1
Log in to your Bridgewater Systems device command line interface (CLI).
Step 2
To log operational messages to the RADIUS and Diameter servers, open the
following file:
/etc/syslog.conf
Step 3
To log all operational messages, uncomment the following line:
local1.info /WideSpan/logs/oplog
Step 4
To log error messages only, change the
local1.info /WideSpan/logs/oplog
line to the following:
local1.err /WideSpan/logs/oplog
NOTE
RADIUS and Diameter system messages are stored in the /var/adm/messages
file.
Step 5
Add the following line:
local1.*@<IP address>
Where
<IP address>
is the IP address of the Event Collector.
Step 6
The RADIUS and Diameter server system messages are stored in the
/var/adm/messages file. Add the following line for the system messages:
<facility>.*@<IP address>
Where:
<facility>
is the facility used for logging to the /var/adm/messages file.
<IP address>
is the IP address of the Event Collector.
Step 7
Save and exit the file.
Step 8
Send a hang-up signal to the syslog daemon to make sure all changes are
enforced:
kill -HUP `cat /var/run/syslog.pid`