Enterasys Security Information and Event Manager, Configuration Manual

Page: 95 / 426

Configuring DSMs
19 EMC VMW
ARE
The SIEM EMC VMWare DSM accepts events from virtual environments using
either the VMWare protocol or syslog. SIEM records all relevant events from the
VMWare Web service.
Select one of the following configuration methods:
•
Configuring Syslog for VMWare
• Configuring the VMWare Protocol
Configuring Syslog
for VMWare
The syslog configuration for VMWare allows you to forward events using syslogd
from your ESXi 3.5 or 4.x server to SIEM.
To configure VMWare ESXi using syslog, perform the following steps:
Step 1
Log in to your VMWare vSphere Client.
Step 2
Select the host managing your VMWare inventory.
Step 3
Click the Configuration tab.
Step 4
From the Software panel, click Advanced Settings .
The Advanced Settings window is displayed.
Step 5
On the left-hand navigation, click Syslog .
Step 6
Configure values for the following parameters:
Step 7
Click OK to save the configuration.
Table 19-2
Parameter Description
Syslog.Local.Datastor
ePath Type the directory path for the local syslog messages on
your ESXi server. The fault directory path is
[]
/scratch/log/messages
.
Syslog.Remote.Hostn
ame Type the IP address or hostname of SIEM.
Syslog.Remote.Port Type the port number the ESXi server uses to forward syslog
data. The default is port 514.