Multiple Syslog servers

[ChristopherStan]

I have a requirement to forward my system logs to multiple servers.  I have a procedure that requires editing the syslog-ng.conf file to specify the servers.  However, upon upgrading to RSA AM 8.4, I do not find this file on my appliance.  What has changed?  How do I specify multiple logging servers?

[EricaChalfin · Accepted solution]

Christopher Stanford‌,

I think you are looking for 000037206 - How to configure RSA Authentication Manager 8.4 or later to send data to multiple remote....

Let us know if this works for you.

Regards,

Erica

[ChristopherStan]

Thank you Erica Chalfin  for the reply.  That was what I was looking for.  However, once I make these changes does that have any effect on the Logging setting from the GUI at security console, setup, system settings, logging settings?

[EricaChalfin]

Christopher Stanford‌,

Shout out to Tyler Mahoney-Eggers for testing.   He set the GUI to internal database and local OS syslog and then unassigned a token from a user.  He states that the change is reflected in the syslog server.

Regards,

Erica

[TylerMahoneyEgg]

Hi Christopher, 

Please note when configuring the logging under security console -> setup -> system settings -> logging settings.

you will want to choose Apply the above settings to the replica instance(s) upon save.

Regards, 

Tyler Mahoney-Eggers