Important Notice: Our web hosting provider recently started charging us for additional visits, which was unexpected. In response, we're seeking donations. Depending on the situation, we may explore different monetization options for our Community and Expert Contributors. It's crucial to provide more returns for their expertise and offer more Expert Validated Answers or AI Validated Answers. Learn more about our hosting issue here.

How does the Monitoring Center receive syslog events from concerned devices?

April 26, 2017center concerned Devices events monitoring syslog

0

Posted

How does the Monitoring Center receive syslog events from concerned devices?

1 Answer

0

Posted

A. IDS MC does not listen on UDP port 514 to capture syslog events. It relies on the unix syslogd service to capture the events. The installation of Security Monitor will configure the /etc/syslog.conf to redirect the relevant events to a log file. Security Monitor reads the events from the log file. The syslogd service should be enabled and configured to receive events from remote hosts. Q. Can I configure the log file from which the receiver reads events? A. Yes. You can configure the log file. Use the utility RxSyslogConf, which is available in /opt/CSCOpx/MDC/bin/ids directory as follows: RxSyslogConf -c The utility will configure the /etc/syslog.conf file also, so that the syslogd service can dump the events in the new log file. Q. How can I prune the log file from which the receiver reads events? A. Use the command RxSyslogConf -p. Do not edit the file manually. Q. Running the IDS MC utilities (IdsPruning, RxSyslogConf, etc) throws errors. What do I do? A.