Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 142 / 426

Configuring DSMs
126 HP
A log file protocol source allows SIEM to retrieve archived log files from a remote
host. The HP Tandem DSM supports the bulk loading of log files using the log file
protocol source.
When configuring your HP Tandem device to use the log file protocol, make sure
the hostname or IP address configured in the HP Tandem device is the same as
configured in the Remote Host parameter in the Log File Protocol configuration.
For more information, see the
Log Sources User Guide .
The SafeGuard Audit file names have the following format:
Annnnnnn
The single alphabetic character
A
is followed by a seven-digit decimal integer
nnnnnnn
, which increments by one each time a name is generated in the same
audit pool.
You are now ready to configure the log source and protocol in SIEM:
Step 1
From the Log Source Type drop-down list box, select HP Tandem .
Step 2
To configure the log file protocol, from the Protocol Configuration drop-down list
box, select Log File .
Your system must be running the latest version of the log file protocol to integrate
with an HP Tandem device:
For information about installing and configuring the log file protocol, see the Log
Sources User Guide.
For more information about HP Tandem see your vendor documentation.
Hewlett Packard
UNIX (HP-UX)
You can integrate an HP-UX device with SIEM. An HP-UX DSM accepts events
using syslog. Before you configure SIEM to integrate with an HP-UX device, you
must:
Step 1
Log in to the HP-UX device command line interface.
Step 2
Open the following file:
/etc/syslog.conf
Step 3
Add the following line:
<facility>.<level> <destination>
Where:
<facility>
is auth.
<level>
is info.
<destination>
is the IP address of the SIEM system.
Step 4
Save and exit the file.