How to get logs from linux

[Former Member]

Hi,

     I want to get logs from the following, I have tried the following but still it is not gathering logs. I tried to upload sample logs but it can parse the logs. I have tried linux agent but still it doesn't gather logs.

1. CentOS 5 and 6

type of logs: messages,maillog,lastlog

path: /var/log

config made:

Vendor: UNIX

Data source type that I have tried: Linux(ASP), UNIX OS (Solaris, Red Hat, Linux, HP-UX, IBM AIX), Generic(ASP)

2.) Zimbra

type of log: zimbra.log

path: /var/log

config made:

Vendor: UNIX

Data source type that I have tried: Linux(ASP), UNIX OS (Solaris, Red Hat, Linux, HP-UX, IBM AIX), Generic(ASP)

3.) Elastix VOIP

type of log (filename): full, full.1,full.2

config made:

Vendor: UNIX

Data source type that I have tried: Linux(ASP), UNIX OS (Solaris, Red Hat, Linux, HP-UX, IBM AIX), Generic(ASP)

4.) Apache installed on Ubuntu

type of logs: access.log

path: /var/log/apache2

config made:

Vendor: apache

Data source type that I have tried: apache web(ASP), apache HTTP

5.) PepLink

type of log: syslog

config I made:

Vendor: Generic Syslog

Data source: Advance Syslog Parser

SNMP v2 enabled

[Former Member]

Are you sure you config syslog at Linux push log to McAfee SIEM?

If you sure config it, you can check syslog push McAfee SIEM via command:

tcpdump -i eth0 src  x.x.x.x and port 514

Eth0 is card connect with Linux

x.x.x.x: is IP of Linux

Can you capture at command ?

[Former Member]

1.) configure apache to send logs to syslog -

2.) configure syslog to send logs to your receiver-

3.) tcpdump on receiver to verify traffic over 514

[esher72]

My CentOS boxes are set up as follows:

In /etc/rsyslog.conf I have:

# ### end of the forwarding rule ###

*.* @@X.X.X.X:514

With X.X.X.X as the IP of my receiver. If I SSH to my receiver and run tcpdump, I see the syslog coming. If you don't see it, then you need to troubleshoot that first.

Then in the ESM, I have the datasource set to Linux (ASP). I have had one person in McAfee support tell me to use "UNIX OS (Solaris, Red Hat, Linux, HP-UX, IBM AIX), Generic(ASP)" and another has said that CentOS wasn't Red Hat enough and that "Linux(ASP)" worked better. Your call there I guess.

[Former Member]

Hi,

you must use Linux (ASP) for all Unix platforms, for Apache use Apache (ASP). All DataSources not-asp are conisiderated legacy and they are deprecated.

Rgds,

[Former Member]

Don't put the port 514 in the syslog file, it doesn't need it. 🙂