Currently, our environment is saving Administrative Audit Log Data & Runtime Audit Log Data to internal database and remote Syslog server. Is it possible to have multiple Syslog servers in this field? The Help contents indicate singular IP Address or Hostname.
Thanks,
Scott Tipton
There is an RFE, Request for Enhancement, to allow Auth Manager to send syslogs to more than one destination. I believe the RFE identifier is AM-22033 - RFE - Ability to specify an alternate server
RFEs typically get driven by customers through Sales, so if you have a contact from RSA, ping them. You could optionally open a support case asking specifically for this, so your case can be added to the other customers requesting this, to kind of show the product manager the amount of demand for this feature.
You cannot do it in the security console. But it can be done.
Send syslog to the syslog-ng component, and have syslog-ng deal with it.
1) security console, send syslog to the IP address of the RSA server itself.
2) as root on command line
edit /etc/syslog-ng/syslog-ng.conf
a) just under here
#source my_src { .... };
#
change this
udp(ip(127.0.0.1") port(514));
to this
udp(ip("0.0.0.0") port(514));
and
b) change this
#
# Enable this and adopt IP to send log messages to a log server.
#
#destination logserver { udp("10.10.10.10" port(514)); };
#log { source(src); destination(logserver); };
to something like my example (I am sending to three syslog servers)
destination logserver {
udp("10.101.99.140" port(514));
udp("192.168.100.100" port (514));
udp("1.2.5.6" port (514));
};
3) bump syslog
service syslog restart
NOTE: none of what I wrote above is 'officially supported', but is a workaround until
we can do this entirely in the security console. It is 'syslog-ng' 101 so if you need more info
syslog-ng.org has details in how syslog-ng operates.
Thank You Edward!
There is an RFE, Request for Enhancement, to allow Auth Manager to send syslogs to more than one destination. I believe the RFE identifier is AM-22033 - RFE - Ability to specify an alternate server
RFEs typically get driven by customers through Sales, so if you have a contact from RSA, ping them. You could optionally open a support case asking specifically for this, so your case can be added to the other customers requesting this, to kind of show the product manager the amount of demand for this feature.