Configuring syslog for PostFix Mail Transfer Agent
To collect events, you must configure syslog on your PostFix MTA installation to forward mail events to IBM® QRadar®.
- Use SSH to log in to your PostFix MTA installation as a root user.
Edit the following file:
To forward all mail events, type the following command to change
-/var/log/maillog/ to an IP address. Make sure that all other lines remain
Where <IP address> is the IP address of the QRadar Console, Event Processor, or Event Collector, or all-in-one system.
- Save and exit the file.
- Restart your syslog daemon to save the changes.