Sun Solaris And Linux Hosts; Configure The Solaris Or Linux Host To Generate Events; Configure Syslogd To Publish To The Mars Appliance - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

Sun Solaris and Linux Hosts

Sun Solaris and Linux Hosts
To configure MARS to receive and process Solaris or Linux host log information, you must perform
three tasks:
•
•
•

Configure the Solaris or Linux Host to Generate Events

MARS Appliance can receive syslog information from a Linux/Solaris host. To configure the
Linux/Solaris applications, you must configure the following applications to write to syslog:
•
•
To configure these applications to write to the system log, follow these steps:
Step 1 xferlog (which provides transfer logging information from the FTP server)
inetd trace messages (which provide the authentication information for services provided using inetd)
Step 2
Other messages will automatically appear in the syslog and do not need to be specifically configured.
Once you have enabled the message generation, you must configure the sylogd deamon to publish
Step 3
messages to the MARS Appliance. For more information, see
Appliance, page

Configure Syslogd to Publish to the MARS Appliance

Once you have enabled the correct applications to write to the system log, you must configure the syslog
daemon on the Solaris or Linux host to publish syslog messages to the MARS Appliance.
To configure the Solaris or Linux host to publish syslogs to the MARS Appliance, follow these steps:
Edit /etc/syslog.conf file and add the line below:
Step 1
where MARS_hostname is the hostname or IP address of the MARS Appliance.
Run following commands to restart syslogd so that the changes are process:
Step 2
User Guide for Cisco Security MARS Local Controller
10-2
Configure the Solaris or Linux Host to Generate Events, page 10-2
Configure Syslogd to Publish to the MARS Appliance, page 10-2
Configure MARS to Receive the Solaris or Linux Host Logs, page 10-3
xferlog
inetd
For ftpd, add the following to
log transfers real,guest,anonymous inbound,outbound log syslog+xferlog
For inetd, the line in
/usr/sbin/inetd -s
needs to be changed to:
/usr/sbin/inetd -t -s
10-2.
*.debug @MARS_hostname
/etc/init.d/syslog stop
Chapter 10 Configuring Generic, Solaris, Linux, and Windows Application Hosts
/etc/ftpd/ftpaccess
/etc/rc2.d/S72inetsvc
:
that reads:
Configure Syslogd to Publish to the MARS
78-17020-01