Configuring syslog on Linux OS

Configuring Linux® OS to forward events by using the syslog connector.

Procedure

  1. Log in to your Linux OS device, as a root user.
  2. Open the /etc/syslog.conf file and add the following facility information: 
    authpriv.*@<ip_address>

    Where:

    <ip_address> is the IP address of the QRadar® product.

  3. Save the file.
  4. Restart syslog by typing the following command:
    service syslog restart
  5. Log in to the QRadar product.
  6. Add a Linux OS data source in the QRadar product.

    For more information about syslog, see the Linux documentation (https://www.linux.com/what-is-linux/).