Enterasys Security Information and Event Manager, Configuration Manual

Page: 60 / 426

Configuring DSMs
44 C
HECK
P
OINT
$FWDIR/bin/fw log -ftn | /usr/bin/logger -p
<facility>.<priority> > /dev/null 2>&1 &
Where:
<facility>
is a Syslog facility, for example,
local3
.
<priority>
is a Syslog priority, for example,
info
.
For example:
$FWDIR/bin/fw log -ftn | /usr/bin/logger -p local3.info >
/dev/null 2>&1 &
Step 5
Save and close the file.
Step 6
Open the syslog.conf file.
Step 7
Add the following line:
<
facility
>.<
priority
> <
TAB
><
TAB
>@<
host
>
Where:
<
facility
> is the syslog facility, for example,
local3
. This value must match the
value you typed in Step 4 .
<
priority
> is the syslog priority, for example,
info
or
notice
. This value must
match the value you typed in Step 4 .
<
TAB
> indicates you must press the Tab key.
<
host
> indicates the SIEM managed host.
Step 8
Save and close the file.
Step 9
Depending on your operating system, type the following command to restart
syslog:
In Linux:
service syslog restart
In Solaris:
/etc/init.d/syslog start
Step 10
Type the following command:
nohup $FWDIR/bin/fw log -ftn | /usr/bin/logger -p
<facility>.<priority> > /dev/null 2>&1 &
Where:
<facility>
is a Syslog facility, for example, local3 . This value must match the
value you typed in Step 4
.
<priority>
is a Syslog priority, for example, info . This value must match the
value you typed in Step 4
.
Step 11
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Check Point Firewall-1 device:
Step 1
From the Log Source Type drop-down list box, select Check Point FireWall-1 .
Step 2
From the Protocol Configuration drop-down list box, select Syslog .