How to add Topsec device in EventLog Analyzer
Objective
EventLog Analyzer collects logs from Topsec devices using the Syslog protocol. Syslog services has to be configured in Topsec Devices to have the logs forwarded to EventLog Analyzer.
This article offers you step by step instructions to add Topsec Device in EventLog Analyzer.
Prerequisites
Before adding a Topsec device, ensure:
- Access to Topsec Device as administrator to perform syslog configuration.
- Review the listener ports of EventLog Analyzer instance in Listener Port Settings and ensure to configure the Unix/Linux device to forward the logs to the same port & protocol. (Default UDP - 514/513, TCP - 514, TLS - 513)
- Proper firewall rules in EventLog Analyzer server(inbound), Security Application(if available) and Network Firewall(if available) and Unix/Linux device (outbound) to allow the communication from Topsec Device to EventLog Analyzer server.
- The Topsec device hostname - IP address must be resolvable by the EventLog Analyzer server (important for DHCP-based IP changes).
- For TLS log collection, Ensure to enable HTTPs for EventLog Analyzer by applying SSL. Refer How to enable HTTPs for EventLog Analyzer
Steps to Follow
Step 1: Configure Syslog service in Topsec Device:
NOTE: Below steps are provided as a sample configuration. For actual configuration for your model/Version, check out with the vendor for actual syslog configuration.
To configure the Syslog service in your Topsec devices, follow the steps below:
- Login to the Topsec device as an administrator.
- Navigate to Logs and alarms > Log Settings
- Configure the details as mentioned below:
- Server address - Provide EventLog Analyzer's server address
- Server port - Enter 513 or 514 which is EventLog Analyzer's default syslog collection port
- Transmission type - Syslog
- Select the Whether to transmit check box.
- Ensure that you DO NOT select 'Whether to combine transmission data' and 'Whether the data is encrypted or not' check boxes.
- Log level - Information
- Check all the necessary Log Type boxes
- Select Input Log language as English
- Click Apply to save the above settings
Step 2: Ensure to allow communication from Topsec Device to EventLog Analyzer server over the ports that are listened by EventLog Analyzer for syslog configuration. You can check or reconfigure the listened ports in Listener Port Settings
Step 3: Check if the logs have reached the EventLog Analyzer server using Log Receiver or built-in packet capture tool.
Step 4: Once the packet reaches EventLog Analyzer server and if the Local Firewall or Security Applications allow the traffic over the listener ports, the log packets will be collected by the application.
Step 5: The device will be added automatically in the application with the device name by resolving the DNS. You can locate the device name in Settings >> Log Source Configuration >> Devices >> Syslog device.
Step 6: If the device name exists already as Syslog Device, collected logs will be auto mapped to the same entry.
Verification
To confirm that the device is added and logs are collected:
- Go to Search → Log Search in ELA.
- Select the device from the list and search for incoming logs.
Tips
1. How does a device name is determined during initial auto addition once syslog packet reaches EventLog Analyzer ?
The value/name that you are able to see in the User interface is "Display name" which will be same as device name value initially. Display name can be changed based on requirement using Update device option.
Device name value will be auto identified based on the source information available in the syslog packet and DNS resolution. There are two scenarios with two cases.
Scenario 1: Source information has Hostname of Syslog device. EventLog Analyzer attempts to resolve with DNS to get the IP address.
Case 1: EventLog Analyzer server is able to resolve the Hostname with IP address using DNS.
Device will be added with "Device name" value as "Hostname" and "IP address" value with its "IP address"
Case 2: EventLog Analyzer server is unable to resolve the Hostname with IP address using DNS. (Due to unavailablity of DNS server or internal DNS resolution issue)
Device will be added with "Device name" value as "Hostname" and "IP address" value with its "Device name"
Scenario 2: Source Information has IP address of Syslog device. EventLog Analyzer attempts to resolve with DNS to get the Hostname.
Case 1: EventLog Analyzer server is able to resolve the IP address with Hostname using DNS.
Device will be added with "Device name" value as "Hostname" and "IP address" value with its "IP address"
Case 2: EventLog Analyzer server is unable to resolve the IP Address with Hostname using DNS.
Device will be added with "Device name" value as "IP Address" and "IP address" value with the "IP address"
2. If multiple devices forward logs via a relay server, EventLog Analyzer uses the hostname from syslog packets to differentiate devices.
How it works:
Prerequisite: Forwarded syslogs should adhere to standard RFC 3164 and the corresponding Relay server configuration must be enabled in EventLog Analyzer.
Sample Log - <34>Oct 18 22:00:15 rootmachine su: 'su root' failed for test on /dev/pts/
NOTE: The hostname ( rootmachine ) is parsed from the syslog packet and the syslog device is added with the hostname.
- If the hostname is already present in the database, then the logs will be mapped to that device.
- The syslog device can be Unix, Topsec , Topsec , Palto Alto,etc.
2. When the IP addresses of syslog devices change frequently due to DHCP, a new device is added with a new IP address whenever the IP changes and if the name cannot be resolved.
How it works:
Prerequisite: Forwarded syslogs from all the syslog devices to Eventlog Analyzer should adhere to standard RFC 3164 and the corresponding DHCP configuration must be enabled in EventLog Analyzer.
Sample Log - <34>Oct 18 22:00:15 rootmachine su: 'su root' failed for test on /dev/pts/8
NOTE: The hostname( rootmachine ) is parsed from the syslog packet and the syslog device is added with the hostname.
- If the hostname is already present in the database, then the logs will be mapped to the respective device.
New to ADSelfService Plus?
Related Articles
How to add F5 device in EventLog Analyzer
Objective EventLog Analyzer collects logs from F5 devices using the Syslog protocol. Syslog services has to be configured in F5 Devices to have the logs forwarded to EventLog Analyzer. This article offers you step by step instructions to add F5 ...How to add HP-UX/Solaris/AIX device in EventLog Analyzer
Objective EventLog Analyzer collects logs from HP-UX/Solaris/AIX devices using the Syslog protocol. Syslog services has to be configured in HP-UX/Solaris/AIX Devices to have the logs forwarded to EventLog Analyzer. This article offers you step by ...How to create a custom Device Group in EventLog Analyzer
Objective This article offers detailed information on how to create a Custom Device Group in EventLog Analyzer. Prerequisites Need access to EventLog Analyzer console with an administrator role or a role with delegated Manage Device Group permission. ...How to add a print server in EventLog Analyzer
Objective This document outlines the procedure for integrating a print server with ManageEngine EventLog Analyzer. Monitoring print servers is essential for maintaining operational efficiency and safeguarding against unauthorized data access. By ...Enabling historic log collection in EventLog Analyzer
EventLog Analyzer collects all the logs present in the Windows Event Viewer (i.e., Windows Logs > Application, Security, System) when the historic log collection option is enabled. To enable historic log collection, follow the steps below: Navigate ...