Enterasys Security Information and Event Manager, Configuration Manual

Page: 51 / 426

Configuring DSMs
CA ACF2 35
Where:
<IPADDR>
is the IP address or host name of the interim FTP server to receive
the output file.
<USER>
is the user name required to access the interim FTP server.
<PASSWORD>
is the password required to access the interim FTP server.
<THEIPOFTHEMAINFRAMEDEVICE>
is the destination of the mainframe or
interim FTP server receiving the output.
For example:
PUT 'Q1JACK.QEXACF2.OUTPUT.C320' /192.168.1.101/ACF2/QEXACF2.
OUTPUT.C320
<QEXOUTDSN>
is the name of the output file saved to the interim FTP server.
You are now ready to configure the Log File protocol. See Pulling Data Using
Log File Protocol .
b
Schedule SIEM to retrieve the output file from CA ACF2.
If the zOS platform is configured to serve files through FTP, SFTP, or allow SCP,
then no interim FTP server is required and SIEM can pull the output file directly
from the mainframe. The following text must be commented out using //* or
deleted from the
QexACF2_jcl.txt
file:
//FTP EXEC PGM=FTP,REGION=3800K
//INPUT DD *
<IPADDR>
<USER>
<PASSWORD>
PUT '<ACFOUT>' EARL_<THEIPOFTHEMAINFRAMEDEVICE>/<ACFOUT>
QUIT
//OUTPUT DD SYSOUT=*
//SYSPRINT DD SYSOUT=*
You are now ready to configure the Log File protocol. See Pulling Data Using
Log File Protocol .
Pulling Data Using
Log File Protocol
A log file protocol source allows SIEM to retrieve archived log files from a remote
host. The CA ACF2 DSM supports the bulk loading of log files using the log file
protocol source.
When configuring your CA ACF2 DSM to use the log file protocol, make sure the
hostname or IP address configured in the CA ACF2 is the same as configured in
the Remote Host parameter in the Log File protocol configuration.