cancel
turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
anas.ismail
anas.ismail
Level 9
‎03-13-2016 04:28 AM

Sending Syslog to More than one SIEM Receiver

Hi

We have two SIEM solutions McAfee Nitro And Arcsight in the environment, Now we are sending the access logs in CEF format to our Arcsight receiver, Can we send the syslog to both Arcsight in CEF format and for McAfee Nitro ELM ?! and if possible how to configure this ?!

Thanks

Anas 

0 Kudos
Reply
2 Replies
anas.ismail
anas.ismail
Level 9
‎03-24-2016 12:05 AM

Re: Sending Syslog to More than one SIEM Receiver

Gentle Reminder

0 Kudos
Reply
eelsasser
eelsasser
Level 15
‎03-24-2016 06:39 AM

Re: Sending Syslog to More than one SIEM Receiver

Configure one for level 6 (info):

Syslog (6, User-Defined.logLine)

Configure the second one for level 5 (notice):

Syslog (5, User-Defined.logLine)

Set your rsyslog.conf to sent to the applicable server

daemon.notice @192.168.1.10

daemon.info @192.168.1.20

make sure you exclude writing both info and notice to disk:

*.info;daemon.!=info;daemon.!=notice;mail.none;authpriv.none;cron.none-/var/log/messages
0 Kudos
Reply