connect epo to rsyslog server

[farhook14]

hello, 

is there any way to connect epo server to rsyslog server?

thanks. 

[LKS]

Hi farhook14,

To register syslog server into EPO server, please follow the below steps.

1. Select Menu | Configuration | Registered Servers, then click New Server.

2 From the Server type menu on the Description page, select Syslog Server, specify a unique name and any details, then click Next.

3 From the Registered Server Builder page, configure these settings:

a  Server name — Use DNS-style domain names (for example, internaldomain.com) and fully qualified
domain names or IP addresses for servers. (for example, server1.internaldomain.com or
192.168.75.101)
b  TCP port number — Type the syslog server TCP port. The default is 6514.
c  Enable event forwarding — Click to enable event forwarding from Agent Handler to this syslog server.
d  Test — Click Test Connection to verify the connection to your syslog server.

4 Click Save.

After you register the syslog server, you can set McAfee ePO to send events to your syslog server. This log file includes any syslog server errors that might occur.

Additionally please go through the below article to know Encryption requirements for ePolicy Orchestrator syslog integration.

https://kc.mcafee.com/corporate/index?page=content&id=KB91194

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a Solution" if this reply resolves your query!

[farhook14]

i think, epo use TLS 1.2 for communicate with Syslog server (KB87927). i don't know how to configure linux syslog server for epo server. i've searched a lot but i can't find any useful solution.

[cdinet · Accepted solution]

Maybe this will help?  We can't assist with that type config since it is not our product.  Yes, we do use tls 1.2.

https://www.loggly.com/docs/rsyslog-tls-configuration/