How to add Unix/Linux device in EventLog Analyzer

How to add Unix/Linux device in EventLog Analyzer

Objective

EventLog Analyzer collects logs from Unix/Linux devices using the Syslog protocol. Devices can be configured automatically from EventLog Analyzer user interface or manually from the respective log source.
This article explains both methods in detail to configure and add Unix/Linux device in EventLog Analyzer.

Prerequisites  

Before adding a Unix/Linux device, ensure:
  • The syslog service is provided by a syslog daemon such as rsyslog, syslog-ng, or the traditional sysklogd. To install syslog daemon refer Tips at the bottom of the document.
  • Review the listener ports of EventLog Analyzer instance in Listener Port Settings and ensure to configure the Unix/Linux device to forward the logs to the same port & protocol. (Default UDP - 514/513, TCP - 514, TLS - 513)
  • Proper firewall rules in EventLog Analyzer server(inbound), Security Application(if available) and Network Firewall(if available) and Unix/Linux device (outbound)  to allow the communication from Unix/Linux instance to EventLog Analyzer server.
  • The Unix/Linux device hostname is resolvable by the EventLog Analyzer server (important for DHCP-based IP changes).
  • For TLS log collection, Ensure to enable HTTPs for EventLog Analyzer by applying SSL. Refer How to enable HTTPs for EventLog Analyzer
  • Below requsites for Automatic syslog configuration:
 
PORTS
INBOUND
OUTBOUND
SERVICE
Additional Rights and Permissions
TCP/22
Linux Device
EventLog Analyzer Server
SSH
User Rights:
Service restart rights for 'rsyslog' or 'syslog' service.
User Permissions:
 

Steps to follow

Syslog service can be configured in Unix/Linux device in two ways.

Method 1: Manual configuration  

When syslog messages are received from a Unix/Linux device that is not already added in EventLog Analyzer:
  1. Configure syslog service in Unix/Linux device.
To find the Syslog service used, use the below command
 
ps aux | grep syslog
As a result, this will return the current running Syslog service.
Follow the steps below to configure log forwarding to EventLog Analyzer server based on the Syslog Service used.
  1. Add the required entries in the configuration file based on protocol. Restart the syslog daemon service to apply the changes
syslogd
      • File path: /etc/syslog.conf
      • UDP:
      • *.*<space/tab>@<eventloganalyzer_server_name>:<port_no>
rsyslogd
File path: /etc/rsyslog.conf
UDP:
*.*<space/tab>@<eventloganalyzer_server_name>:<port_no>
TCP:
*.*<space/tab>@@<eventloganalyzer_server_name>:<port_no>
TLS:
      • $DefaultNetstreamDriverCAFile <CACertificate>
      • $ActionSendStreamDriver gtls
      • $ActionSendStreamDriverMode 1
      • $ActionSendStreamDriverAuthMode x509/name
      • $ActionSendStreamDriverPermittedPeer <commonname>
      • *.*<space/tab>@@<eventloganalyzer_server_name>:<port_no>
syslog-ng
      • File path: /etc/syslog-ng/syslog-ng.conf
      • <source_name> can be found from existing configuration of source with system(); and internal(); calls in the syslog-ng.conf file
      • destination d_eventloganalyzer { network(<eventloganalyzer_server_name> port(<port>) transport("udp")); };
        log { source(<source_name>); destination(d_eventloganalyzer); };
TCP:
destination d_eventloganalyzer { network(<eventloganalyzer_server_name> port(<port>) transport("tcp")); };
log { source(<source_name>); destination(d_eventloganalyzer); };
TLS:
destination d_eventloganalyzer { network(<eventloganalyzer_server_name> port(<port>) transport("tls") tls(key-file("/path/to/private.key") cert-file("/path/to/certificate.crt") ca-dir("/path/to/ca/directory"))); };
log { source(<source_name>); destination(d_eventloganalyzer); };
  1. Save the configuration and restart the Syslog daemon using the below command
    • service <syslog/rsyslog/syslog-ng> restart
    • systemctl restart <syslog/rsyslog/syslog-ng>
NOTE: The above configuration will only enable forwarding the machine logs to the EventLog Analyzer server.
3. Ensure the above mentioned Prerequisites are met to have the communication between Unix/Linux device and EventLog Analyzer instance.
4. The application automatically detects the device once the log packet reaches the application. You can see the live packets incoming in Log Receiver.
5. The device appears under the Settings >> Log source configuration >> Devices >> Syslog Devices list in EventLog Analyzer.

Method 2: Auto configuration for Unix/Linux device.

  1. Log in to the EventLog Analyzer web console as an Administrator or with privileged role to Configure and Manage syslog device.
  2. Navigate to:
    Settings → Log Source Configuration >> Devices → Syslog Devices.
  3. Click + Add Device(s).
     
  4. Choose the addition method:
a) Discovery-based addition  
    • Select Discover Devices.
    • Provide the IP address / IP range / CIDR.
    • (Optional) Enter SNMP credentials for additional details.
    • Click Discover.
b) Manual addition  
    • Select Add Manually.
    • Enter the Hostname / IP Address of the device.
    • Choose the Device Type as Unix/Linux.
    • Click Add.
  1. Once added, the device will appear in the Syslog Devices list.
  2. Enable Check box for the device(s) and choose Configure Auto Log Forward
  1. Enter the credential which has access to syslog daemon over remote, Unix/Linux SSH port, Syslog Protocol & port number(for which the logs has to be forwarded). Refer prerequisites to know the user permission required.
  1. Choose Verify & Update

Verification   

To confirm that the device is added and logs are collected:
  1. Go to Search → Log Search in ELA.
  2. Select the device from the list and search for incoming logs.
  3. If logs are not visible, verify syslog forwarding on the device (see Configuring Syslog on Unix/Linux Devices).

Tips

1. If syslog daemon in not installed, follow the below steps to instal the syslog daemon.

Step 1: Check if a Syslog Daemon is Already Installed  
Run:
ps -ef | grep syslog
or
systemctl status rsyslog
If it is running, you don’t need to install it again.

Step 2: Install Syslog Service  
On Debian/Ubuntu:  
sudo apt update
sudo apt install rsyslog -y
On RHEL/CentOS/Oracle Linux:  
sudo yum install rsyslog -y
or (on newer versions):
sudo dnf install rsyslog -y
On SUSE Linux:  
sudo zypper install rsyslog

Step 3: Enable and Start the Syslog Service  
After installation, enable it at boot and start the service:
sudo systemctl enable rsyslog
sudo systemctl start rsyslog
Check status:
systemctl status rsyslog
 
2. If multiple devices forward logs via a relay server, EventLog Analyzer uses the hostname from syslog packets to differentiate devices.
How it works:  
Prerequisite: Forwarded syslogs should adhere to standard RFC 3164 and the corresponding Relay server configuration must be enabled in EventLog Analyzer.
Sample Log - <34>Oct 18 22:00:15 rootmachine su: 'su root' failed for test on /dev/pts/
 
NOTE: The hostname ( rootmachine ) is parsed from the syslog packet and the syslog device is added with the hostname.
  • If the hostname is already present in the database, then the logs will be mapped to that device.
  • The syslog device can be Unix, Cisco, Fortinet, Palto Alto,etc.
3. When the IP addresses of syslog devices change frequently due to DHCP, a new device is added with a new IP address whenever the IP changes and if the name cannot be resolved.
How it works:  
Prerequisite: Forwarded syslogs from all the syslog devices to Eventlog Analyzer should adhere to standard RFC 3164 and the corresponding DHCP configuration must be enabled in EventLog Analyzer.
Sample Log - <34>Oct 18 22:00:15 rootmachine su: 'su root' failed for test on /dev/pts/8
 
NOTE: The hostname( rootmachine ) is parsed from the syslog packet and the syslog device is added with the hostname.
  • If the hostname is already present in the database, then the logs will be mapped to the respective device.
 Related topics and articles   


      New to M365 Manager Plus?
      New to M365 Manager Plus?
        New to RecoveryManager Plus?
        New to RecoveryManager Plus?
          New to Exchange Reporter Plus?
          New to Exchange Reporter Plus?
            New to SharePoint Manager Plus?
            New to SharePoint Manager Plus?
                See all integrations
                New to ADManager Plus?
                See all integrations
                New to ADManager Plus?

                  New to ADSelfService Plus?

                  Start your free trial
                  Start your free trial

                    • Related Articles

                    • How to add Topsec device in EventLog Analyzer

                      Objective EventLog Analyzer collects logs from Topsec devices using the Syslog protocol. Syslog services has to be configured in Topsec Devices to have the logs forwarded to EventLog Analyzer. This article offers you step by step instructions to add ...

                    • How to add F5 device in EventLog Analyzer

                      Objective EventLog Analyzer collects logs from F5 devices using the Syslog protocol. Syslog services has to be configured in F5 Devices to have the logs forwarded to EventLog Analyzer. This article offers you step by step instructions to add F5 ...

                    • How to add HP-UX/Solaris/AIX device in EventLog Analyzer

                      Objective EventLog Analyzer collects logs from HP-UX/Solaris/AIX devices using the Syslog protocol. Syslog services has to be configured in HP-UX/Solaris/AIX Devices to have the logs forwarded to EventLog Analyzer. This article offers you step by ...

                    • How to forward application logs hosted on Linux/Unix machine

                      Objective This article outlines the steps required to collect logs from an application hosted in Unix/Linux device by configuring syslog service to forward log data to ManageEngine EventLog Analyzer. This setup allows centralized logging, monitoring, ...

                    • No data or logs collected from syslog device

                      Issue description During the initial setup or while using EventLog Analyzer, you might notice that logs are not being collected from a syslog device or that syslog device reports do not show any recent data. EventLog Analyzer uses device status ...

                      Related Products