Adding a DSM

If your Device Support Module (DSM) is not automatically discovered, manually install a DSM.

Each type of log source has a corresponding DSM that parses and normalizes events from the log source.

Procedure

  1. Download the DSM RPM file from the IBM® support website (http://www.ibm.com/support).
  2. Copy the RPM file to QRadar.
  3. Using SSH, log in to the QRadar host as the root user.
  4. Go to the directory that includes the downloaded file.
  5. Type the following command:

    yum -y install <rpm_filename>

    Note: The rpm -Uvh <rpm_filename> command line to install was replaced with the yum -y install <rpm_filename> command.
  6. Log in to QRadar.
  7. On the Admin tab, click Deploy Changes.
    Restriction: Uninstalling a Device Support Module (DSM) is not supported in QRadar.