Configure IBM Storage Protect

To collect IBM Storage Protect events, configure your IBM Storage Protect servers to send events to QRadar.

Configure your IBM Storage Protect environment so it can forward the syslog events. To configure IBM Storage Protect, complete the following steps:

Edit the /etc/rsyslog.conf file to add the following line at the end:
```
*.*@<QRadarIP>:514
```
Where:
- *.* specifies instruction to send all logs.
- @ is the TCP/UDP protocol.
- <QRadarIP> is the IP of your QRadar server through port 514.
Restart the Syslog service by running the following command:
```
systemctl restart rsyslog
```