Configuring log forwarding using the UI
You can forward the appliance system logs (syslogs) to an external log management server. Your log management server must support the Rsyslog client.
To configure log forwarding:
- Sign in to the Access Appliance UI by using the
http://console-ip:14161URL, where console-ip is the management console IP address. - Do one of the following:
Click Dashboard > Security Meter > View details > Auditing and alerting > Log forwarding
Click Settings > Security management > Log forwarding
- Click Configure.
- Enter the following details:
Field
Description
Server FQDN or IP address
FQDN or the IP address of the external log management server.
Server port
Port number of the external log management server. Default port is 514. You can specify a different port if the log server is configured to listen on that port.
Protocol
Select either UDP or TCP. TCP is the default protocol. With TCP protocol, you can optionally enable TLS log transmission.
Note:
Enabling TLS requires that you upload certificates obtained from CA authority and a private key to the appliance.
Log polling interval
Duration in minutes after which the log server polls for the system logs. Logs on the remote log server will be available after that duration.
Set the interval in minutes. The options are 15, 30, 45, 60, Continuous. If you select Continuous, the appliance continuously forwards logs to the log server.
Device vendor
Unique name for the external log server. You can use any name to identify to which server the appliance is forwarding the logs to.
Enable TLS log transmission
If you want to secure the transmission of logs from the appliance to the log server, select Enable TLS log transmission and upload the required certificate files. Veritas recommends that you enable TLS for security purposes.
This option provides end-to-end security of data sent over the network from the appliance to the log server. You need a CA certificate and the client private key to configure TLS log transmission.
This option is available only if you select the TCP protocol.
If you enable secure log transmission, upload CA certificate (X.509 certificate for the certificate authority in PEM format), client certificate (X.509 certificate for the appliance to communicate with the log management server, in PEM format), and client certificate key (RSA key of the client certificate) onto your log server and then upload the certificates to the appliance.
Modules
Types of logs that are forwarded to the log server. Only the OS logs are forwarded and the syslog option is selected by default.
- Click Enable.
A notification about the task is displayed on the top of the page. To monitor the progress, click View details. After the configuration is completed successfully, a notification is displayed on top of the page. The log forwarding status is shown Enabled and the start time for forwarding the logs is displayed.
See Forwarding logs to an external server.