Adding a DSM

If your Device Support Module (DSM) is not automatically discovered, manually install a DSM.

Each type of log source has a corresponding DSM that parses and normalizes events from the log source.

Procedure

  1. Download the DSM RPM file from the IBM® support website (http://www.ibm.com/support).
  2. Copy the RPM file to QRadar®.
  3. Using SSH, log in to the QRadar host as the root user.
  4. Go to the directory that includes the downloaded file.
  5. Type the following command:

    yum -y install <rpm_filename>

    Note: The rpm -Uvh <rpm_filename> command line to install was replaced with the yum -y install <rpm_filename> command.
  6. Log in to QRadar.
  7. On the Admin tab, click Deploy Changes.
    Restriction: Uninstalling a Device Support Module (DSM) is not supported in QRadar.