IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  IBM QRadar v7.3.1 - Log Source for syslog-ng

    Posted Thu November 29, 2018 02:15 AM
    Edited by Ming Zheng Lee Thu November 29, 2018 02:17 AM
    Hi All,

    I have a QRadar All-in-One virtual machine running on v7.3.1. I have configured a Windows Server deployed with syslog-ng to send syslog to the QRadar server. However on my QRadar server, I am unable to see the log source being detected automatically. Why is this so? Appreciate all kind response.

    Thank you.

    Gary

    ------------------------------
    Ming Zheng Lee
    ------------------------------


  • 2.  RE: IBM QRadar v7.3.1 - Log Source for syslog-ng

    Posted Fri November 30, 2018 04:52 AM
    Hi,

    You can troubleshoot using tcpdump, IBM QRadar: Using the command-line to troubleshoot a syslog event source - United States
    Ibm remove preview
    IBM QRadar: Using the command-line to troubleshoot a syslog event source - United States
    I forwarded my Syslog events to QRadar, but I do not see any events on the Log Activity tab. How can I use the command-line to troubleshoot event issues?
    View this on Ibm >

    Next, chech if any firewall is between those hosts.

    Also, check the auto detection IBM QRadar: Understanding Traffic Analysis and Log Source Auto Detection - United States
    Ibm remove preview
    IBM QRadar: Understanding Traffic Analysis and Log Source Auto Detection - United States
    What is Traffic Analysis?
    View this on Ibm >

    Check that syslog-ng is using port 514

    Hope this helps!


    ------------------------------
    AC
    ------------------------------

    Original Message


  • 3.  RE: IBM QRadar v7.3.1 - Log Source for syslog-ng

    Posted Sun January 20, 2019 12:33 AM
    Hi Ming,
    we also forward windows logs using syslog-ng. This is not a supported method by IBM, but it works great. They recommend using their agent wincollect or windows MSRPC protocol.

    Windows logs are multiline, therefore you can't send the logs on 514, because it can only handle single line logs. You'll need to create a listener on another port that will reassemble the multiline logs. Here's IBM procedure for the listener:

    https://www.ibm.com/support/knowledgecenter/en/SS42VS_DSM/t_DSM_guide_Splunk_logsource.html

    This listener will automatically detect all the windows log source servers and create them, and as a gateway, it will assign each log to the right log source in Qradar if it already exists. As for the syslog-ng config, you need to send the logs un-modified with no special header to your Qradar event collector IP on the listener port you've created, and in TCP. It should work just fine.

    Unfortunately, I'm not allowed to give you SNG configs or screenshots of my Qradar configuration, since it belongs to my employer, and I do not have autorisation to share the information. If you have a good unix admin, I'm sure he'll be just fine with SNG. And you may ask IBM support for help on the listener.

    You could replace SNG by MSRPC...
    https://www-01.ibm.com/support/docview.wss?uid=swg21700170

    If it's too complicated, you may want to install wincollect.

    I hope this helped.
    Regards,

    ------------------------------
    Anthony Gayadeen
    ------------------------------

    Original Message


Related Content