000017542 - How to verify RSA Authentication Manager (AM) 8.1 is sending syslog data to a remote syslog server.

Use the RSA Authentication Manager (AM) 8.1 Security console - Setup - System Settings.  Then click on the Logging Link.  Select either Primary or Replica(s), [Next>].  Set Log Levels, then scroll down to Log Data Destination. 

There are 3 types of log data; Administrative Audit, Runtime Audit (includes Authentications), and System (includes system errors like failures to connect to remote LDAP Identity Source). 

There are also three ways to save log data, bottom choice is both Internal Database and remote Syslog at the following hostname or IP address.  [Save]

SSH to the Suse Linux operating system with the OS account (rsaadmin or whatever has been configured).

     sudo su -                     <to become root - same password>
     # service syslog status               <should showed as running>
     # ps -ef | grep syslog

     # tcpdump -i eth0 host <IP_syslog>           <screen should show RSA sending syslog packets to this syslog server on UDP port 514>