Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 364 / 426

Configuring DSMs
348 S
UN
S
OLARIS
FTP Transfer Mode This option only appears if you select FTP as the Service
Type. The FTP Transfer Mode parameter allows you to define
the file transfer mode when retrieving log files over FTP.
From the drop-down list box, select the transfer mode you
want to apply to this log source:
•
Binary - Select Binary for log sources that require binary
data files or compressed zip, gzip, tar, or tar+gzip archive
files.
•
ASCII - Select ASCII for log sources that require an ASCII
FTP file transfer. You must select NONE for the Processor
parameter and LINEBYLINE the Event Generator
parameter when using ASCII as the FTP Transfer Mode.
SCP Remote File If you select SCP as the Service Type you must type the file
name of the remote file.
Start Time Type the time of day you want the processing to begin. This
parameter functions with the Recurrence value to establish
when and how often the Remote Directory is scanned for files.
Type the start time, based on a 24 hour clock, in the following
format: HH:MM.
Recurrence Type the frequency, beginning at the Start Time, that you
want the remote directory to be scanned. Type this value in
hours (H), minutes (M), or days (D).
For example, type 2H if you want the directory to be scanned
every 2 hours. The default is 1H.
Run On Save Select the check box if you want the log file protocol to run
immediately after you click Save. After the Run On Save
completes, the log file protocol follows your configured start
time and recurrence schedule.
Selecting Run On Save clears the list of previously processed
files for the Ignore Previously Processed File(s) parameter.
EPS Throttle Type the number of Events Per Second (EPS) that you do not
want this protocol to exceed. The valid range is 100 to 5000.
Processor If the files located on the remote host are stored in a zip, gzip,
tar, or tar+gzip archive format, select the processor that
allows the archives to be expanded and contents processed.
Ignore Previously
Processed File(s) Select the check box to track files that have already been
processed and you do not want the files to be processed a
second time. This only applies to FTP and SFTP Service
Types.
Change Local
Directory? Select the check box to define the local directory on your
SIEM system that you want to use for storing downloaded files
during processing. We recommend that you leave the check
box clear. When the check box is selected, the Local Directory
field is displayed, which allows you to configure the local
directory to use for storing files.
Table 66-2 Log File Parameters (continued)
Parameter Description