Microsoft Sharepoint Logs

[professor_is]

Dear friends.

Our team has enciuntered with an issue, which is connected with sharepoint logs. What have been done:

1. Created Data Source to accept logs from Sharepoint (screenshot provided below)

2. Remotely installed SIEM Collector Application on Windows 2012 Sever and General Configuration Policy was configured (Screenshot provided)

The problem is that Debug logs have not been delievered from indicated path to datasource (receiver). Does anybody encountered and fixed the problem like mine? It seems to me that it's common issue.

[penoffd]

Not to hijack the thread, but you were able to get the collector to run on Windows 2012 Server?  We have been trying to do this for some months without success.

[garethrhys]

Please look at Article in another thread.

You could also look up device support using LOGbinder for SharePoint, SQL, and Exchange which is integrated through SIA partnership.

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/25000/PD25449/en_US/...

Seems to be an issue with the PDF file as I write this - will report.

[rmcse04]

Hi,

We are able to collect SharePoint logs, however unable to get the user name details from the Sharepoint events. i.e. SharePoint's audit log does not provide the names of users or objects. is there a way to fetch the users details or objects?

[Raph19]

This might be a bit late for the original posters but I have spent so much time looking at these configs, for anyone else looking at the screenshots above. You may want to consider:

Checking "Generate Host IDs:"
(Default) Receiver Port: 8082
Data Retrieval: MEF (when use SIEM Collector 11.0 etc)
Changing 'Data Retrieval' will change "Host Name" to add generated "Host ID:"