How to include the hostname in the syslog output for RSA Authentication Manager 8.x
Originally Published: 2013-10-04
Article Number
Applies To
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.x
Issue
Cause
Resolution
- Make a backup of the file /etc/syslog-ng/syslog-ng.conf.
cp /etc/syslog-ng/syslog-ng.conf./etc/syslog-ng/syslog-ng.conf.bk
- Open the syslog-ng.conf.in a text editor, such as vi.
- Edit /etc/syslog-ng/syslog-ng.conf, changing
udp(ip("127.0.0.1") port(514));
to
udp(ip("x.x.x.x") port(514));
where, x.x.x.x is the IP address of the Authentication Manager server. With the IP address the command is udp(ip("192.168.2.50") port(514));
- Restart the syslog daemon:
/etc/init.d/syslog restart
- Configure Authentication Manager to forward syslog events.
- In the Security Console, navigate to Setup > System Settings > Logging.
- Select the primary server and click Next.
- Change the logging settings to Save to internal database and remote SysLog at the following hostname or IP address.
- Put the Authentication Manager's IP using in step 3 above into the field for the server to log to.
- Now all events logged to syslog will have the server's short hostname. By default with syslog the hostname is to the right of the date and timestamp.
Example RSA log entry:
Oct 4 09:32:18 am8p 2013-10-04 09:32:18,534, , audit.runtime.com.rsa.ims.session.impl.SessionManagerImpl, INFO, b51d194d3202a8c01a734ebc86e27d5c,f375d7e63202a8c00822bc73cb5c8122,,192.168.2.50, AUTHN_LOGOUT_EVENT,13001,SUCCESS,,cd4fa0343202a8c01b4a7edfce034bf7-vYx1cUR3CIFY,000000000000000000001000d0021000, 000000000000000000001000d0011000,000000000000000000001000e0011000,admin,Admin,Admin,,,,,,,,,,,,,,,,,,,,
Example non-RSA entry:
Oct 4 09:20:25 am8p sshd[5389]: Server listening on 0.0.0.0 port 22.
Related Articles
maximum open cursors exceeded Number of Views F5 BIG-IP APM 14.1 - Risk-Based Authentication Configuration - RSA Ready SecurID Access Implementation Guide Number of Views Citrix Systems NetScaler Gateway - RSA SecurID Access Implementation Guide Number of Views Cannot Do AceInitialize for communication with ACE/Server with RSA SecurID Authentication Agents for PAM when using sdopts Number of Views 'Could not retrieve current IPv6 configuration status' error when editing or creating RADIUS clients on RSA Authentication… Number of Views
Trending Articles
Quick Setup Guide - Passwordless Authentication in Windows MFA Agent for Active Directory RSA Announces Critical Security Updates for RSA ID Plus Components - RSA Authentication Manager and RSA Identity Router RSA MFA Agent 9.0 for PAM - Installation and Configuration Guide for Oracle Linux RHEL Ubuntu CentOS and Rocky Linux Explanation of successful authentication followed by passcode reuse and bad tokencode messages in RSA Authentication Manag… Quick Setup Guide - FIDO
Don't see what you're looking for?
