Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 186 / 426

Configuring DSMs
170 J
UNIPER
N
ETWORKS
Where
<IP address>
is the IP address of the Event Collector you want to
connect to the database.
Step 4
Reload the Postgres service:
su - nsm -c "pg_ctl reload -D /var/netscreen/DevSvr/pgsql/data"
Step 5
As the Juniper Networks NSM user, create the view:
create view strm_avt_view as SELECT a.name, a.category,
v.srcip,v.dstip,v.dstport, v."last", u.name as userinfo, v.id,
v.device, v.vlan,v.sessionid, v.bytecnt,v.pktcnt, v."first" FROM
avt_part v JOIN app a ON v.app =a.id JOIN userinfo u ON
v.userinfo = u.id;
The view is created.
Step 6
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Juniper Networks AVT device:
Step 1
From the Log Source Type drop-down list box, select Juniper Networks AVT .
Step 2
You must also configure the JDBC protocol for the log source. Use the following
parameters to configure the JDBC protocol:
a
Database Type - From the Database Type drop-down list box, select
Postgres .
b
Database Name - Type
profilerDb
.
c
IP or Hostname - Type the IP address of the Juniper Networks NSM system.
d
Port - Type
5432
.
e
Username - Type the username for the profilerDb database.
f
Password - Type the password for profilerDB database.
g
Table Name - Type
strm_avt_view
.
h
Select List - Type
*
for the select list.
i
Compare Field - Type
id
for the Compare Field.
j
Use Prepared Statements -The Use Prepared Statements check box must be
clear. The Juniper Networks AVT DSM does not support prepared statements.
k
Polling Interval - Type
10
for the Polling interval.
NOTE
The Database Name and Table Name parameters are case sensitive.
For more information on configuring log sources and protocols, see the Log
Sources User Guide .
For more information about the Juniper Networks AVT device, see your vendor
documentation.