000011922 - How to include the hostname in the syslog output for Authentication Manager 8.x

Document created by RSA Customer Support Employee on Jun 14, 2016•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000011922
Applies ToAuthentication Manager Version 8
Syslog server
IssueHow to include the hostname in the syslog output for Authentication Manager 8.x
All Authentication Manager log entries are written with the hostname of "localhost" in syslog.
 
CauseThe local syslog server is configured by default to listen on 127.0.0.1 and will not accept connections using any configuration in the security console other than Log to "local operating system SysLog"
 
ResolutionTo work around this issue and have the hostname present in the syslog, perform the following:
1. Make a backup of the file /etc/syslog-ng/syslog-ng.conf
2. Edit /etc/syslog-ng/syslog-ng.conf
Change
udp(ip("127.0.0.1") port(514));
to
udp(ip("192.168.2.50") port(514));

In my example 192.168.2.50 is my Authentication Managers IP.


3. Restart the syslog daemon:
   /etc/init.d/syslog restart



4. Configure Authentication Manager to forward syslog events:
    Launch Security Console:
    Navigate to Setup / System Settings / Logging
    Select the Primary and click next
    Change the logging settings to: ?Save to internal database and remote SysLog at the following hostname or IP address:?
      Put the Authentication Manager?s IP (in my case 192.168.2.50) into the field for the server to log to.
    Now all events logged to syslog will have the server?s short hostname. 
    By default with syslog the hostname is to the right of the date and timestamp.


Example RSA Log entry:


Oct  4 09:32:18 am8p 2013-10-04 09:32:18,534, , audit.runtime.com.rsa.ims.session.impl.SessionManagerImpl, INFO, b51d194d3202a8c01a734ebc86e27d5c,f375d7e63202a8c00822bc73cb5c8122,,192.168.2.50,AUTHN_LOGOUT_EVENT,13001,SUCCESS,,cd4fa0343202a8c01b4a7edfce034bf7-vYx1cUR3CIFY,000000000000000000001000d0021000,000000000000000000001000d0011000,000000000000000000001000e0011000,admin,Admin,Admin,,,,,,,,,,,,,,,,,,,,


Example Non RSA entry:


Oct  4 09:20:25 am8p sshd[5389]: Server listening on 0.0.0.0 port 22.

Legacy Article IDa62694

Attachments

    Outcomes