ExtraHop Trace Admin UI, Руководство пользователя

Страница: 19 / 58

ExtraHop 8.8 ExtraHop Trace Admin UI Guide 19
Note: Most organizations have an established system for collecting and displaying SNMP traps in a
central location that can be monitored by their operations teams. For example, SNMP traps
are sent to an SNMP manager, and the SNMP management console displays them.
1. Log in to the Administration settings on the ExtraHop system through
https://<extrahop-
hostname-or-IP-address>/admin
.
2. In the Network Settings section, click Notifications .
3. Under Notifications, click SNMP .
4. On the SNMP Settings page, in the SNMP Monitor field, type the hostname for the SNMP trap
receiver. Multiple names can be entered, separated by commas.
5. In the SNMP Community field, enter the SNMP community name.
6. In the SNMP Port field, type the SNMP port number for your network that is used by the SNMP agent
to respond back to the source port on the SNMP manager.
The default response port is
162
.
7. Click Test Settings to verify that your SNMP settings are correct. If the settings are correct, you should
see an entry in the SNMP log file on the SNMP server similar to the following:
Connection from UDP: [192.0.2.0]:42164->[ 192.0.2.255]:162
Where
192.0.2.0
is the IP address of your ExtraHop system and
192.0.2.255
is the IP address of
the SNMP server.
8. Click Save .
Download the ExtraHop SNMP MIB
SNMP does not provide a database of information that an SNMP-monitored network reports. SNMP
information is defined by third-party management information bases (MIBs) that describe the structure of
the collected data.
1. Log in to the Administration settings on the ExtraHop system through
https://<extrahop-
hostname-or-IP-address>/admin
.
2. Go to the Network Settings section and click Notifications .
3. Under Notifications, click SNMP .
4. Under SNMP MIB, click the Download ExtraHop SNMP MIB .
The file is typically saved to the default download location for your browser.
Send system notifications to a remote syslog server
The syslog export option enables you to send alerts from an ExtraHop system to any remote system that
receives syslog input for long-term archiving and correlation with other sources.
Only one remote syslog server can be configured for each ExtraHop system.
1. Log in to the Administration settings on the ExtraHop system through
https://<extrahop-
hostname-or-IP-address>/admin
.
2. In the Network Settings section, click Notifications .
3. In the Destination field, type the IP address of the remote syslog server.
4. From the Protocol drop-down menu, select
TCP or UDP . This option specifies the protocol over which
the information will be sent to your remote syslog server.
5. In the Port field, type the port number for your remote syslog server. By default, this value is set to
514.
6. Click Test Settings to verify that your syslog settings are correct. If the settings are correct, you should
see an entry in the syslog log file on the syslog server similar to the following:
Jul 27 21:54:56 extrahop name="ExtraHop Test" event_id=1
7. Click Save .