Use this page to configure Privileged Account Manager so that it can send syslog messages to a syslog server. This server can be a Sentinel server, a Sentinel Log Manager, or a syslog server that supports TCP with optional TLS or SSL support. Older syslog servers require UDP for the transport protocol.
Click Setting > External Services on the home page of the console.
Click Syslog Server.
Configure the following fields:
Hostname/IP Address: Specify the DNS name or IP address of the syslog server.
Port: Specify the port the syslog server is listening on for syslog events. The default port is 514. The default port for a Sentinel server or a Sentinel Log Manager is 1468.
SSL: Move the slider to the right to enable SSL communication with a Sentinel server. For a syslog server, do not select this box.
Allow Persistent Connections: Move the slider to the right to enable a connection in which, a single connection provides multiple responses instead of opening a new connection for every single request and response.
Audit Zone: Move the slider to the right to enable the audit manager in a audit zone to send the audit data to syslog emitter.
NOTE:To use this, ensure that Audit Zone is configured and at least one Syslog emitter is present in each Audit Zone.
NOTE:To apply the changes made to the persistent connection, you must restart Privileged Account Manager.
The category and events are listed, and are in the enabled status. You can however disable the status of a specific event by moving the slider to the left.
Command Audit: If you have enabled auditing on the user’s session or on commands, this option sends all audited events as syslog events.
For information on configuring commands for auditing, see Using the Command Rewrite Functionality for Command Arguments.
For information on using a .profile file to enable session auditing, see Complete Session Control Using pcksh.
Privilege Escalation: Sends an event when a user starts a privileged session.
To remove an event, highlight it, move the Status slider to left. By default all the events’ status is set to enabled.
To configure the format, click the format text box and specify a format string.
The ${}$ string logs the complete string of the audit record in JSON format. For a Sentinel server, format string must be set to ${}$.
If you are sending the events to a syslog server, you can specify strings from the Privileged Account Manager templates. For example, the format of the Start Session event could use the following string:
User ${StartSession.user}$ initiated a Command Control session from ${StartSession.host}$
This format string would produce output similar to the following:
Jan 1 01:20:45 localhost npum: User ctaylor initiated a Command Control session from citlaptop
Click Update. The sample output looks similar to the following string:
(sev:[0 TO 5]) AND pn:("NetIQ Privileged Account Manager")For Privilege Account Manager to communicate with a Sentinel server, you need to add a Syslog Connector to the Sentinel console. You can download the Syslog Connector from the Sentinel Plug-ins website. This connector must be configured to listen on port TCP 514 using SSL and the SSL type must be Open. Configure it to listen specifically for the host that has the Syslog Emitter installed. This is usually the Framework Manager console.