Mumbai Security and Compliance User Group

Centos Integration process ( 1.1.1.1 is IP add of centos syslog server & centossyslog is hostname)

The CENTOS server needs to be configured to forward the logs from syslog daemon to the Collector PC on which SSIM Agent and Unix syslog collector is running.

In order to receive logs the below mentioned changes needs to be carried out at CENTOS server.

1. Addition of below statement in /etc/hosts file  (this is a IP address of SSIM agent )

             1.1.1.1  Centossyslog

1. Addition of below statement in the /etc/syslog.conf  file (This will forward CENTOS logs to Agent Server i.e 10.226.6.238)
   *.info @Centossyslog
2. Restart the Syslogd service.  Service syslog restart

Note :-  IF server has firewall in between then need to open UDP-514 Port. Unidirectional

1    Source CENTOS server -> destination SSIM Collection Server (1.1.1.1) with unidirection port UDP-514.

Configure the collector machine to receive remote syslog events.

 To configure the collector machine to receive remote syslog events

1 On the Linux machine on which the collector will be installed, use an editor such as vi to open the /etc/sysconfig/syslog file.

2 Change the line

SYSLOGD_OPTIONS="-m 0"

to the following:

SYSLOGD_OPTIONS="-m 0 -r -x"

3 Save and close the syslog file.

4 To enable receipt of remote syslog messages, type the following command:

service syslog restart