Syslog Server

Send Events to Syslog

The Syslog server is used for integration with a SIEM system and serves as a unified data storage for PAM event records and/or text session logs. Data is updated in real time: during an active remote connection, not after its completion.

To send Event log records to a Syslog server, configure the configuration files according to the instructions below.
Sending text session logs to a Syslog server is configured in the Configuration section.

Windows

1. Go to the C:\inetpub\wwwroot\ls\targetConfigs folder, create a copy of the sampleSyslog.config file and rename it to Pam.Syslog.config, then edit the <Settings> … </Settings> according to the information below:

   • HostName — Syslog server name 
   • Port — Syslog port number 
   • Protocol — Syslog connection type: TCPoverTLS, TCP, UDP
   • Format — logging format: Plain, CEF, LEEF
   • SyslogVersion — select syslog protocol: RFC3164, RFC5424
     
     
   C:\inetpub\wwwroot\ls\targetConfigs

   <Settings HostName="localhost" Port="5081" Protocol="TCP" Format="CEF" SyslogVersion="RFC3164" />

2. In the C:\inetpub\wwwroot\ls\clientApps.config file edit pam section for work with the Pam.Syslog.config file. Add a new TargetId for the WriteTarget:

   C:\inetpub\wwwroot\ls\clientApps.config

   <Application Id="pam" SchemaId="Pam.Schema">
     <ReadTargetId>Pam.TargetDb</ReadTargetId>
     <WriteTargets>
       <TargetId>Pam.TargetDb</TargetId>
       <TargetId>Pam.Syslog</TargetId>
     </WriteTargets>
     <AccessControl>
       <!--<CertificateAccessControl CertificateThumbprint="001122...AA11" Rights="Read" />-->
     </AccessControl>
   </Application>

3. In the same file, in the Targets section add a new element, it should be the same as the configuration file name without extension:

   C:\inetpub\wwwroot\ls\clientApps.config

   <Targets>
     ...
     <Target Id="Pam.TargetDb" Type="mssql"/>
     <Target Id="Pam.Syslog" Type="syslog"/>
   </Targets>

   In Target Id="Pam.TargetDb" specify Type depending on the database you are using: mssql or pgsql.

Linux

1. Go to the /etc/axidian/axidian-pam/ls/targets folder, edit the <Settings> … </Settings> section of the Pam.Syslog.config file according to the information below:

   • HostName — Syslog server name 
   • Port — Syslog port number 
   • Protocol — Syslog connection type: TCPoverTLS, TCP, UDP
   • Format — logging format: Plain, CEF, LEEF
   • SyslogVersion — select syslog protocol: RFC3164, RFC5424
     
     
   /etc/axidian/axidian-pam/ls/targets

   <Settings HostName="localhost" Port="5081" Protocol="TCP" Format="CEF" SyslogVersion="RFC3164" />

2. In the /etc/axidian/axidian-pam/ls/clientApps.config file edit pam section for work with the Pam.Syslog.config file. Add a new TargetId for the WriteTarget:

   /etc/axidian/axidian-pam/ls/clientApps.config

   <Application Id="pam" SchemaId="Pam.Schema">
     <ReadTargetId>Pam.DbTarget</ReadTargetId>
     <WriteTargets>
       <TargetId>Pam.DbTarget</TargetId>
       <TargetId>Pam.Syslog</TargetId>
     </WriteTargets>
     <AccessControl>
       <!--<CertificateAccessControl CertificateThumbprint="001122...AA11" Rights="Read"/>-->
     </AccessControl>
   </Application> 

3. In the same file, in the Targets section add a new element, it should be the same as the configuration file name without extension:

   /etc/axidian/axidian-pam/ls/clientApps.config

   <Targets>
     ...
     <Target Id="Pam.DbTarget" Type="mssql"/>
     <Target Id="Pam.Syslog" Type="syslog"/>
   </Targets> 

   In Target Id="Pam.DbTarget" specify Type depending on the database you are using: mssql or pgsql.

Send Text Logs to Syslog

To configure sending session text logs to the Syslog server, do the following:

1. In the administrator console, go to Configuration → System Settings.

2. Fill in the Syslog server parameters.

   Option	Description
   Syslog server	IP address or DNS name of Syslog server
   Port	Syslog server port
   Protocol	Network protocol for connection to Syslog server: TCP, UDP
   Format	Event format used by syslog server: CEF, LEEF
   Syslog version	IETF standard of Syslog protocol: RFC3164, RFC5424

3. Once the data is filled in, click Check connection to the Syslog server.
   Make sure that the test message has arrived at the Syslog server.