Hi
We have two SIEM solutions McAfee Nitro And Arcsight in the environment, Now we are sending the access logs in CEF format to our Arcsight receiver, Can we send the syslog to both Arcsight in CEF format and for McAfee Nitro ELM ?! and if possible how to configure this ?!
Thanks
Anas
Gentle Reminder
Configure one for level 6 (info):
Syslog (6, User-Defined.logLine)
Configure the second one for level 5 (notice):
Syslog (5, User-Defined.logLine)
Set your rsyslog.conf to sent to the applicable server
daemon.notice @192.168.1.10
daemon.info @192.168.1.20
make sure you exclude writing both info and notice to disk:
*.info;daemon.!=info;daemon.!=notice;mail.none;authpriv.none;cron.none | -/var/log/messages |
Corporate Headquarters
6220 America Center Drive
San Jose, CA 95002 USA