Log File log source parameters for Sun Solaris BSM

If QRadar does not automatically detect the log source, add a Sun Solaris BSM log source on the QRadar Console by using the Log File protocol.

When using the Log File protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect Log File events from Sun Solaris BSM:

Table 1. Log File log source parameters for the Sun Solaris BSM DSM
Parameter	Value
Log Source type	Solaris BSM
Protocol Configuration	Log File
Log Source Identifier	Type the IP address or host name for the log source. The log source identifier must be unique for the log source type.
Service Type	From the list, select the protocol that you want to use when retrieving log files from a remove server. The default is SFTP. SFTP - SSH File Transfer Protocol FTP - File Transfer Protocol SCP - Secure Copy The underlying protocol that is used to retrieve log files for the SCP and SFTP service types requires that the server specified in the Remote IP or Hostname field has the SFTP subsystem enabled.
Remote IP or Hostname	Type the IP address or host name of the Sun Solaris BSM system.
Remote Port	Type the TCP port on the remote host that is running the selected Service Type. If you configure the Service Type as FTP, the default is 21. If you configure the Service Type as SFTP or SCP, the default is 22. The valid range is 1 - 65535.
Remote User	Type the user name necessary to log in to your Sun Solaris system. The user name can be up to 255 characters in length.
Remote Password	Type the password necessary to log in to your Sun Solaris system.
Confirm Password	Confirm the Remote Password to log in to your Sun Solaris system.
SSH Key File	If you select SCP or SFTP from the Service Type field you can define a directory path to an SSH private key file. The SSH Private Key File gives the option to ignore the Remote Password field.
Remote Directory	Type the directory location on the remote host from which the files are retrieved. By default, the newauditlog.sh script writes the human-readable logs files to the /var/log/ directory.
Recursive	Select this check box if you want the file pattern to also search sub folders. The Recursive parameter is not used if you configure SCP as the Service Type. By default, the check box is clear.
FTP File Pattern	If you select SFTP or FTP as the Service Type, this gives the option to configure the regular expression (regex) that is needed to filter the list of files that are specified in the Remote Directory. All matching files are included in the processing. For example, if you want to retrieve all files in the <starttime>.<endtime>.<hostname>.log format, use the following entry: `\d+\.\d+\.\w+\.log`. Use of this parameter requires knowledge of regular expressions (regex). For more information, see the following website: http://download.oracle.com/javase/tutorial/essential/regex/
FTP Transfer Mode	This option appears only if you select FTP as the Service Type. The FTP Transfer Mode parameter gives the option to define the file transfer mode when you retrieve log files over FTP. From the list, select the transfer mode that you want to apply to this log source: Binary - Select Binary for log sources that require binary data files or compressed .zip, .gzip, .tar, or .tar+gzip archive files. ASCII - Select ASCII for log sources that require an ASCII FTP file transfer. You must select NONE for the Processor field and LINEBYLINE the Event Generator field when you use the ASCII as the transfer mode.
SCP Remote File	If you select SCP as the Service Type, you must type the file name of the remote file.
Start Time	Type the time of day you want the processing to begin. This parameter functions with the Recurrence value to establish when and how often the Remote Directory is scanned for files. Type the start time, based on a 24-hour clock, in the following format: HH: MM.
Recurrence	Type the frequency, beginning at the Start Time, that you want the remote directory to be scanned. Type this value in hours (H), minutes (M), or days (D). For example, type `2H` if you want the directory to be scanned every 2 hours. The default is 1H.
Run On Save	Select this check box if you want the log file protocol to run immediately after you click Save. After the Run On Save completes, the log file protocol follows your configured start time and recurrence schedule. Selecting Run On Save clears the list of previously processed files for the Ignore Previously Processed File(s) parameter.
EPS Throttle	The maximum number of events per second that QRadar ingests. If your data source exceeds the EPS throttle, data collection is delayed. Data is still collected and then it is ingested when the data source stops exceeding the EPS throttle. The valid range is 100 to 5000.
Processor	If the files on the remote host are stored in a .zip, .gzip, .tar, or tar+gzip archive format, select the processor that allows the archives to be expanded and contents processed.
Ignore Previously Processed File(s)	Select this check box to track files that are processed already, and you do not want the files to be processed a second time. This applies only to FTP and SFTP Service Types.
Change Local Directory?	Select this check box to define the local directory on your QRadar system that you want to use for storing downloaded files during processing. It is suggested that you leave the check box clear. When the check box is selected, the Local Directory field is displayed, which gives you the option to configure the local directory to use for storing files.
Event Generator	From the Event Generator list, select LINEBYLINE.