Security Compliance
Forward events from LEM
Customers at times are required to have logging data in multiple systems and request that data be forwarded from LEM. This article discusses that request and ways to achieve that need.
First published date
Last published date
Overview
You may have a requirement to collect log data in multiple destinations (syslog servers or SIEM devices), which means there may be a need to forward the log data.
This article discusses that request and ways to achieve that need.
Product section
Resolution
NOTE: AS OF THE 6.5 RELEASE, LOG FORWARDING IS NOW SUPPORTED. PLEASE SEE THE FOLLOWING TOPIC: Enable log forwarding
LEM is an SIEM (Security Information and Event Manager), utilizing a syslog server (syslog-ng), but designed as a logging endpoint solution. Numerous network devices can send syslogs directly to more than one syslog server or endpoint solution, but many can only send to one destination.
LEM can receive log data from Windows, Linux, Unix computers, provided a LEM agent has been installed on that computer. LEM cannot forward agent data or SNMP trap data.
While Kiwi Syslog can be utilized to forward syslog data, this requires Kiwi Syslog to be installed on a Windows server. LEM can read the forwarded syslog data from Kiwi or another 3rd party syslog server, provided the syslog-ng protocol is used to send over port 514 to LEM. SolarWinds support can also assist with configuring the Kiwi Syslog.
If you have additional questions on this please open a case with Support.