Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 29 / 426

Configuring DSMs
Configuring Apache Using Syslog-ng 13
LogLevel info
The LogLevel may already be configured to the info level depending on your
Apache installation.
Step 4
Add the following to the Apache configuration file to specify the custom log format:
LogFormat "%h %A %l %u %t \"%r\" %>s %p %b" <log format name>
Where
<log format name>
is a variable name you provide to define the custom
log format.
Step 5
Add the following information to the Apache configuration file to specify a custom
path for the syslog events:
CustomLog "|/usr/bin/logger -t 'httpd' -u
/var/log/httpd/apache_log.socket" <log format name>
The log format name must match the log format defined in Step 4 .
Step 6
Save the Apache configuration file.
Step 7
Edit the syslog-ng configuration file.
/etc/syslog-ng/syslog-ng.conf
Step 8
Add the following information to specify the destination in the syslog-ng
configuration file:
source s_apache {
unix-stream("/var/log/httpd/apache_log.socket"
max-connections(512)
keep-alive(yes));
};
destination auth_destination { <udp|tcp>("<IP address>"
port(514)); };
log{
source(s_apache);
destination(auth_destination);
};
Where:
<IP address>
is the IP address of the SIEM Console or Event Collector.
<udp|tcp>
is the protocol you select to forward the syslog event.
Step 9
Save the syslog-ng configuration file.
Step 10
Type the following command to restart syslog-ng:
service syslog-ng restart
Step 11
You are now ready to configure the log source in SIEM.