Security Compliance

How to set syslog local facility in HP 5130 switches for SEM

This article describes how to set syslog local facility in HP 5130 switches for SEM.

First published date

11/7/2018 6:56 PM

Last published date

11/7/2018 6:56 PM

Overview

Set the syslog local facility in HP 5130 switches for Security Event Manager (formerly Log & Event Manager).

 

Product section

Security Event Manager

Resolution

As stated in the following Manual: HP 5130 EI Switch Series  (© Copyright 2018 Hewlett Packard Enterprise Development LP, available at https://support.hpe.com/hpesc, obtained on Dec 27, 2018)  on page 58 (when searching in the PDF it's page 67 of 319) under the table Outputting logs to a log host.

Step 7 explains the full command:

The command: info-center loghost <loghost-ip-addrees> facility local7

[A different local facility number can most likely be chosen. In this example local7 was used]

Verify Logs coming to SEM

  1. Once this is set, log in to SEM via CMC.
  2. Go to appliance > checklogs > select the facility sequence number corresponding to the local you choose above. Search: /ip-address-of-switch.
  3. The logs should start to appear in this location. For example, local7.
  4. Log in to the SEM Flash console, navigate to Manage > Appliances > Connectors (by selecting the gear icon next to the appliance).
  5. Look for the HP Firewall connector and configure the correct log file path. For example, /var/log/local7. 
  6. Save and start the connector, you should see the events in SEM monitor tab.

Refer to Unmatched data troubleshooting guide if you do see some unmatched data.

Configure the connector in the SEM HTML5 console (versions 6.6 and newer).

  1. In the SEM Events Console, navigate to Nodes > Manager Connectors.
  2. In the search box, enter HP Firewall.
  3. Select the HP Firewall connector, and then click Add Connector.
  4. Ensure the log file path is correct (for example, /var/log/local7), and then click Add.
  5. Under Configured connectors, select the connector, and then click Start.



Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.  You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.