on Sep 4, 2013Hi
As the HSM is not supported by SA by default we need to do it in a custome way.
we are currently trying to fetch the HSM logs stored on a Windows server to SA.we have installed SFTP agent on the Win server as described on the below link
http://docs.netwitness.com/2-RSA_SA10.2_User_Guide/10_Admin_Tasks/40_Configure_Log_Collection/Configure_File_Event_Sources
http://docs.netwitness.com/2-RSA_SA10.2_User_Guide/10_Admin_Tasks/40_Configure_Log_Collection/Configure_File_Event_Sources/05_Install_and_Update_SFTP_Agent
But i could not see any files on the VLC /var/netwitness/~/upload directory.Please help to sort this issue.
Also we need to create a flex parser for the same, please guide on this process as well.
Thanking you in advance.
Dipin Mohan
is this still an issue?
RSA NetWitness Supported Event Sources
Can you provide sample logs for the HSM that can be used to write a log parser (not flex parser).
You will use the LPT1.0 tool to write the log parser which can be found here.
RSA, a Dell Technologies business, announces the release of RSA® NetWitness Log Parser Tool v1.0 and the RSA® NetWitness Log Parser Community