How to add HP-UX/Solaris/AIX device in EventLog Analyzer

How to add HP-UX/Solaris/AIX device in EventLog Analyzer

Objective

EventLog Analyzer collects logs from HP-UX/Solaris/AIX devices using the Syslog protocol. Syslog services has to be configured in HP-UX/Solaris/AIX Devices to have the logs forwarded to EventLog Analyzer.
This article offers you step by step instructions to add HP-UX/Solaris/AIX Device in EventLog Analyzer.

Prerequisites  

Before adding a HP-UX/Solaris/AIX device, ensure:
  • Access to HP-UX/Solaris/AIX Device as administrator to perform syslog configuration.
  • Review the listener ports of EventLog Analyzer instance in Listener Port Settings and ensure to configure the Unix/Linux device to forward the logs to the same port & protocol. (Default UDP - 514/513, TCP - 514, TLS - 513)
  • Proper firewall rules in EventLog Analyzer server(inbound), Security Application(if available) and Network Firewall(if available) and Unix/Linux device (outbound)  to allow the communication from HP-UX/Solaris/AIX Device to EventLog Analyzer server.
  • The HP-UX/Solaris/AIX device hostname - IP address must be resolvable by the EventLog Analyzer server (important for DHCP-based IP changes).
  • For TLS log collection, Ensure to enable HTTPs for EventLog Analyzer by applying SSL. Refer How to enable HTTPs for EventLog Analyzer 

Steps to Follow

Step 1: Configure Syslog service in HP-UX/Solaris/AIX Device:
NOTE: Below steps are provided as a sample configuration. For actual configuration for your model/Version, check out with the vendor for actual syslog configuration.
To configure the Syslog service in your HP-UX/Solaris/AIX devices, follow the steps below:
  1. Login as root user.
  2. Edit the syslog.conf file in the /etc directory as shown below.
*.emerg;*.alert;*.crit;*.err;*.warning;*.notice;*.info;*.debug<tab-separation>@<ela_server_name>
where <ela_server_name> is the name of the machine where EventLog Analyzer is running. Ensure that there is only a tab separation in between *.debug and @<ela_server_name>.
Note: For a Solaris device, it is enough to include *.debug<tab-separation>@<ela_server_name> in the syslog.conf file.
  1. Save the configuration and exit the editor.
  2. Edit the services file in the /etc directory.
  3. Change the syslog service port number to 514, which is one of the default listener of EventLog Analyzer. But if you choose a different port other than 514 then remember to enter that same port when adding the device in EventLog Analyzer.
  4. Start the syslog daemon on the OS with the appropriate command:
(for HP-UX) /sbin/init.d/syslogd start
(for Solaris) /etc/init.d/syslog start
(for Solaris 10) svcadm -v restart svc:/system/system-log:default
(for IBM AIX) startsrc -s syslogd

Step 2: Ensure to allow communication from HP-UX/Solaris/AIX Device to EventLog Analyzer server over the ports that are listened by EventLog Analyzer for syslog configuration. You can check or reconfigure the listened ports in Listener Port Settings
Step 3: Check if the logs have reached the EventLog Analyzer server using Log Receiver or built-in packet capture tool.
Step 4: Once the packet reaches EventLog Analyzer server and if the Local Firewall or Security Applications allow the traffic over the listener ports, the log packets will be collected by the application.
Step 5: The device will be added automatically in the application with the device name by resolving the DNS. You can locate the device name in Settings >> Log Source Configuration >> Devices >> Syslog device. 
Step 6: If the device name exists already as Syslog Device, collected logs will be auto mapped to the same entry.

Verification   

To confirm that the device is added and logs are collected:
  1. Go to Search → Log Search in ELA.
  2. Select the device from the list and search for incoming logs.

Tips

1.  How does a device name is determined during initial auto addition once syslog packet reaches EventLog Analyzer ?
The value/name that you are able to see in the User interface is "Display name" which will be same as device name value initially. Display name can be changed based on requirement using Update device option.
Device name value will be auto identified based on the source information available in the syslog packet and DNS resolution. There are two scenarios with two cases.
​
Scenario 1: Source information has Hostname of Syslog device. EventLog Analyzer attempts to resolve with DNS to get the IP address.
Case 1: EventLog Analyzer server is able to resolve the Hostname with IP address using DNS.
Device will be added with "Device name" value as "Hostname" and "IP address" value with its "IP address"
Case 2: EventLog Analyzer server is unable to resolve the Hostname with IP address using DNS. (Due to unavailablity of DNS server or internal DNS resolution issue)
Device will be added with "Device name" value as "Hostname" and "IP address" value with its "Device name"
Scenario 2: Source Information has IP address of Syslog device. EventLog Analyzer attempts to resolve with DNS to get the Hostname.
Case 1: EventLog Analyzer server is able to resolve the IP address with Hostname using DNS.
Device will be added with "Device name" value as "Hostname" and "IP address" value with its "IP address"
Case 2: EventLog Analyzer server is unable to resolve the IP Address with Hostname using DNS.
Device will be added with "Device name" value as "IP Address" and "IP address" value with the "IP address"
2. If multiple devices forward logs via a relay server, EventLog Analyzer uses the hostname from syslog packets to differentiate devices.

How it works:  
Prerequisite: Forwarded syslogs should adhere to standard RFC 3164 and the corresponding Relay server configuration must be enabled in EventLog Analyzer.
Sample Log - <34>Oct 18 22:00:15 rootmachine su: 'su root' failed for test on /dev/pts/
 
NOTE: The hostname ( rootmachine ) is parsed from the syslog packet and the syslog device is added with the hostname.
  • If the hostname is already present in the database, then the logs will be mapped to that device.
  • The syslog device can be Unix, HP-UX/Solaris/AIX, HP-UX/Solaris/AIX, Palto Alto,etc.
2. When the IP addresses of syslog devices change frequently due to DHCP, a new device is added with a new IP address whenever the IP changes and if the name cannot be resolved.
How it works:  
Prerequisite: Forwarded syslogs from all the syslog devices to Eventlog Analyzer should adhere to standard RFC 3164 and the corresponding DHCP configuration must be enabled in EventLog Analyzer.
Sample Log - <34>Oct 18 22:00:15 rootmachine su: 'su root' failed for test on /dev/pts/8
 
NOTE: The hostname( rootmachine ) is parsed from the syslog packet and the syslog device is added with the hostname.
  • If the hostname is already present in the database, then the logs will be mapped to the respective device.
  


      New to M365 Manager Plus?
      New to M365 Manager Plus?
        New to RecoveryManager Plus?
        New to RecoveryManager Plus?
          New to Exchange Reporter Plus?
          New to Exchange Reporter Plus?
            New to SharePoint Manager Plus?
            New to SharePoint Manager Plus?
                See all integrations
                New to ADManager Plus?
                See all integrations
                New to ADManager Plus?

                  New to ADSelfService Plus?

                  Start your free trial
                  Start your free trial

                    • Related Articles

                    • How to add Topsec device in EventLog Analyzer

                      Objective EventLog Analyzer collects logs from Topsec devices using the Syslog protocol. Syslog services has to be configured in Topsec Devices to have the logs forwarded to EventLog Analyzer. This article offers you step by step instructions to add ...

                    • How to add F5 device in EventLog Analyzer

                      Objective EventLog Analyzer collects logs from F5 devices using the Syslog protocol. Syslog services has to be configured in F5 Devices to have the logs forwarded to EventLog Analyzer. This article offers you step by step instructions to add F5 ...

                    • How to create a custom Device Group in EventLog Analyzer

                      Objective This article offers detailed information on how to create a Custom Device Group in EventLog Analyzer. Prerequisites Need access to EventLog Analyzer console with an administrator role or a role with delegated Manage Device Group permission. ...

                    • How to add a print server in EventLog Analyzer

                      Objective This document outlines the procedure for integrating a print server with ManageEngine EventLog Analyzer. Monitoring print servers is essential for maintaining operational efficiency and safeguarding against unauthorized data access. By ...

                    • Enabling historic log collection in EventLog Analyzer

                      EventLog Analyzer collects all the logs present in the Windows Event Viewer (i.e., Windows Logs > Application, Security, System) when the historic log collection option is enabled. To enable historic log collection, follow the steps below: Navigate ...

                      Related Products