Rsyslog Integration

Rsyslog is an open-source software utility used on UNIX and Unix-like computer systems for forwarding log messages in an IP network. It implements the basic syslog protocol, extends it with content-based filtering, rich filtering capabilities, flexible configuration options and adds features such as using TCP for transport and SSL\TLS for encryption.

  1. In the pop-up window, enter these values:
    Setting Description
    Host Name Host name or IP Address of rsyslog server
    Protocol TLS
    Port

    Port that the rsyslog server is listening on.

    Default SSL port: 443.
    Syslog level

    Severity level of events to send to the server.

    Acceptable Values are:

    • Info

    • Warn

    • Error

    • Debug
    Facility Facility is used to specify the type of program that is logging the message. Messages with different facilities may be handled differently. Defaults to "user".
    Audit TAG

    Because Mobile Security can send 2 formats of logs, Event logs and Audit logs, the receiving rsyslog system publishes 2 parsers for these types.

    When Mobile Security sends an Event type it will add the Event Tag to the message.

    When Mobile Security sends an Audit type it will add the Audit Tag to the message.
    Event TAG

    Because Mobile Security can send 2 formats of logs, Event logs and Audit logs, the receiving rsyslog system publishes 2 parsers for these types.

    When Mobile Security sends an Event type it will add the Event Tag to the message.

    When Mobile Security sends an Audit type it will add the Audit Tag to the message.
    Chain certificate

    The rsyslog server needs to publish unique certificates to establish the secure connection from Mobile Security.

    The chain certificate is the X.509 certificate used to secure the rsyslog server. The root CA of the rsyslog system to which we are going to send logs.
    Certificate

    The rsyslog server needs to publish unique certificates to establish the secure connection from Mobile Security.

    This is the certificate used for the TLS handshake. It is obtained from the rsyslog system that was generated specifically for the integration with Mobile Security.
    Key certificate

    The rsyslog server needs to publish unique certificates to establish the secure connection from Mobile Security.

    This the Private Key certificate used for the TLS handshake. It is obtained from the rsyslog system that was generated specifically for the integration with Mobile Security.
  2. Click Apply.