AdaptiveLogExporterGuide 72 PDF
AdaptiveLogExporterGuide 72 PDF
AdaptiveLogExporterGuide 72 PDF
Version 7.2.0
Note: Before using this information and the product that it supports, read the information in “Notices and
Trademarks” on page page 119.
© Copyright IBM Corp. 2012, 2013 All Rights Reserved US Government Restricted Rights - Use, duplication or
disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
CONTENTS
1 OVERVIEW
Using the Adaptive Log Exporter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Using the Menu. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Using the Toolbar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Using the Preferences Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
4 MANAGING DESTINATIONS
Configuring Destinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Adding a Syslog TCP Destination. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Adding a Syslog UDP Destination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Adding a Logger Destination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Editing a Destination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Deleting a Destination. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
5 CONFIGURING CISCO ACS
Configuring Cisco ACS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Configuring the Cisco ACS Device Plug-in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Creating a Device Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
The Adaptive Log Exporter Guide for IBM Security QRadar SIEM provides you
with information for configuring device plug-ins and receiving events from Windows
hosts within your network.
Intended Audience This guide is intended for the system administrator responsible for setting up the
Adaptive Log Exporter in your network. This guide assumes that you have QRadar
SIEM administrative access and a knowledge of your corporate network and
networking technologies.
NOTE
Indicates that the information provided is supplemental to the associated feature
or instruction.
CAUTION
Indicates that the information is critical. A caution alerts you to potential loss of
data or potential damage to an application, system, device, or network.
WARNING
Indicates that the information is critical. A warning alerts you to potential dangers,
threats, or potential personal injury. Read any and all warnings carefully before
proceeding.
Technical For information on how to access more technical documentation, technical notes,
Documentation and release notes, see the Accessing IBM Security QRadar Documentation
Technical Note.
(http://www.ibm.com/support/docview.wss?rs=0&uid=swg21614644)
Contacting For information on contacting customer support, see the Support and Download
Customer Support Technical Note.
(http://www.ibm.com/support/docview.wss?rs=0&uid=swg21612861)
NOTE
The Adaptive Log Exporter supports a maximum of 20 devices per installation.
NOTE
The Window Event Log is the only Adaptive Log Exporter device plug-in that
supports remote event collection using the Remote Machine check box.
The Adaptive Log Exporter supports remote polling of event logs from the
following operating systems:
- Microsoft Windows 2000
- Microsoft Windows 2003 server
- Microsoft Windows 2008 server
- Microsoft Windows XP
- Microsoft Windows 7
NOTE
Remote event collection in a one-to-many configuration requires the Adaptive Log
Exporter to be configured with domain administration credentials to access
remote event logs. Supplying these credentials can be considered a security risk.
For more information, see Configuring Adaptive Log Exporter Service
Credentials.
After receiving events from the Adaptive Log Exporter, QRadar can analyze,
report, and store the information. To verify that your Windows logs are being
processed by QRadar, use the search function in the Log Activity tab to filter by
the source or destination IP addresses of the devices configured in your Adaptive
Log Exporter. For more information on filtering for events using the Log Activity
tab, see the QRadar Users Guide.
Using the Adaptive The Adaptive Log Exporter provides a number of menu, tool bar, and preference
Log Exporter options.
Using the Menu The Adaptive Log Exporter includes the following menu options:
Table 1-1 Adaptive Log Exporter Menu Options
Icon Description
Save Allows you to save the current device or destination tab.
Tabs with unsaved changes are indicated with an asterisks (*)
symbol.
Save All Allows you to save all device or destination tabs that contain
changes.
Tabs with unsaved changes are indicated with an asterisks (*)
symbol.
Edit Device Allows you to edit the settings of the selected device.
This toolbar button is only available when you select a device that
has been previously saved on the Devices tab.
Edit Allows you to edit the destination for a device.
Destination This toolbar button is only available when you select a destination
that has been previously saved on the Destination tab.
Icon Description
Deploy Allows you to deploy all changes made during the current session.
This toolbar button is available after you have saved a device
configuration or destination.
Add Plugins Allows you to manually check for updated device plug-ins using the
Install/Update site you configured in the preferences for the Adaptive
Log Exporter.
If you receive an error that states the update site is invalid, you must
configure the update site in the Adaptive Log Exporter preferences.
For more information, see Configuring the Update Site.
NOTE
If you change the default values of the Adaptive Log Exporter and you want to
restore default values, select File > Preferences, and then click Restore
Defaults.
Adaptive Log Before you begin installing the Adaptive Log Exporter, you must ensure the
Exporter system Windows-based host of the Adaptive Log Exporter meets the following
requirements requirements:
• The Adaptive Log Exporter can be installed on the following 32-bit or 64-bit
operating systems:
- Windows 2000
- Windows 2003 server
- Windows 2008 server
- Windows 2008R2 server
- Windows XP
- Windows 7
• 8GB of RAM (2GB reserved for the agent)
• Intel Core 2 Duo processor 2.0 GHz or better
Installing the Before installing the Adaptive Log Exporter using the installation wizard, close all
Adaptive Log active applications.
Exporter
Procedure
Step 1 Download the AdaptiveLogExporter_setup.exe file from the IBM Support website.
https://www.ibm.com/support
Step 2 Copy the Adaptive Log Exporter setup file to your Windows-based host system.
Step 3 Double-click the setup file to launch the installation wizard.
Step 4 Click Next.
The End User License Agreement (EULA) is displayed.
Step 5 Read the license agreement information in the window and select I accept the
agreement to continue.
If you select I do not accept the agreement, you cannot continue with the
installation.
Step 6 Click Browse or type the installation location for the Adaptive Log Exporter.
Step 7 From the list box, select Full installation. This option installs the following
components:
• ALE Windows Service - Mandatory. This option installs the Adaptive Log
Exporter service, which is required to forward events to QRadar SIEM.
• ALE Configuration User Interface - Select this check box to Install the
Adaptive Log Exporter user interface. Clearing this check box installs the
Adaptive Log Exporter without the user interface and requires text-based
configuration files.
Note: Installing the Adaptive Log Exporter without the user interface is intended for
advanced users only. For additional information, see Installing and Configuring
ALE Using the CLI.
Step 8 Click Next.
Step 9 Type a name for the Adaptive Log Exporter Start menu folder.
If you do not want to include an Adaptive Log Exporter folder in your Start menu,
select the Don’t create a Start Menu folder check box.
Step 10 Click Next.
Step 11 Configure the available options:
• Create a desktop icon - Select this check box to create an icon on your
desktop for the Adaptive Log Exporter. You can also select one of the following
options:
- For all users - Select this check box to install a desktop icon for all users.
- For the current user only - Select this check box to install a desktop icon for
the logged in user.
• Create a Quick Launch icon - Select the check box to create an icon on your
Quick Launch toolbar.
• Run service now - Select the Run Service Now check box to launch the
Q1WindowsAgent service after the installation is complete.
Step 12 Click Next.
Step 13 Click Install.
Step 14 Click Finish.
Note: If an error occurs when attempting to launch the Adaptive Log Exporter, you
must run the program using the Run as administrator option or set the
compatibility mode in Windows. For more information on troubleshooting your
installation, see Adaptive Log Exporter Troubleshooting.
When the installation process completes, you must configure the location that the
Adaptive Log Exporter uses for updates. These updates download the latest
device plug-ins for the Adaptive Log Exporter. For more information, see
Configuring the Update Site.
Installing and The command line interface (CLI) allows you to install, uninstall, and update
Configuring ALE devices for the Adaptive Log Exporter without the installation wizard. This
Using the CLI document provides information on using the command line interface (CLI) and the
available options. The command line interface allows you to update or deploy your
Adaptive Log Exporter to multiple remote systems using third-party products that
provide remote or batch installs, for example, MSI Packaging Tools,
Message-Oriented Middleware (MOM), or System Center Configuration Manager
(SCCM).
Basic Adaptive Log To install the Adaptive Log Exporter using a CLI:
Exporter CLI
Installation Procedure
Step 1 Download the Adaptive Log Exporter setup file from the IBM support website:
https://www.ibm.com/support
After you download the Adaptive Log Exporter, you must decide on a distribution
method to deploy the Adaptive Log Exporter to remote systems in your network.
Step 2 Close all other active applications before installing the Adaptive Log Exporter.
Step 3 From your desktop, select Start > Run.
Step 4 Type the following command:
cmd
Step 5 Click OK.
Step 6 Navigate to the download directory of the Adaptive Log Exporter.
Step 7 In the CLI, type the following command:
AdaptiveLogExporter_setup.exe /SP- /VERYSILENT
/SUPPRESSMSGBOXES
Note: For additional installation parameters, see Table 2-1.
The SP-, VERYSILENT, and SUPPRESSMSGBOXES parameters are required
parameters for a silent installation without launching the installation wizard or when
using optional installation parameters. Installation commands must be run from the
directory containing the Adaptive Log Exporter setup file.
Step 8 Configure optional installation parameters.
Parameter Description
/DIR Type the fully qualified path name to specify a non-standard
installation directory for the Adaptive Log Exporter.
For example,
/DIR=”D:\Windows Event Tools”
If you do not specify a directory for the installation, the Adaptive
Log Exporter is installed in the Program Files or Program Files
(x86) directory.
Parameter Description
/COMPONENTS Type the following command to specify individual components
you want to install.
The options include:
• main - Allows you to install the Adaptive Log Exporter service
without the configuration wizard.
For example, /COMPONENT=main
• ui - Allows you to install the configuration wizard with the
Adaptive Log Exporter service.
For example, /COMPONENT=main,ui
If you do not include the component parameter, then the service
and configuration wizard are installed.
/NOICONS Type the following command if you do not want to include the
Adaptive Log Exporter icon to display in your Start menu options.
For example,
/NOICONS
/GROUP By default, the Start menu displays the application in a folder
named Adaptive Log Exporter. The group parameter allows you
to define a new group name or add the icon to an existing group.
For example,
/Group=”System”
or
/Group=”Accessories\System Tools”
Note: If you specify an existing group name, the Adaptive Log
Exporter icon is added to the existing folder or sub folder.
Advanced Installation The default installation of the Adaptive Log Exporter only includes two device
with Windows Event plug-ins: Windows Event Log and the File Forwarder plug-in.
Log Monitoring
The advanced installation parameters for the Adaptive Log Exporter command line
allow you to configure a Windows Event Log device plug-in during the installation.
The advanced installation commands are typically used to install the Adaptive Log
Exporter on the remote Windows host to monitor Windows events from the
installation location.
Procedure
Step 1 Copy the AdaptiveLogExporter_setup.exe to the remote location.
Step 2 From the desktop of the remote machine, select Start > Run.
The Run window is displayed.
Step 3 Type the following command:
cmd
The example above installs the Adaptive Log Exporter service on the remote
Windows host and configures the Windows Event Log. The Windows Event log
collects application, security, and system logs from the local installation and
forwards the events to the QRadar SIEM Console or Event Collector at
10.100.100.100 using TCP on port 514.
Parameter Description
/MONITOR Allows you to specify the list of event logs you want to monitor
on the Windows operating system. The following Windows
event logs can be monitored:
• Application
• Security
• System
• **Directory Service
• **DNS Server
• **File Replication
The event log types must be separated using a
comma-separated list.
For example,
/MONITOR=”Application”,”Security”,”System”,”Di
rectory Service”,”DNS Server”
Note: The ** indicates that these Windows Event Logs can be
configured using the command line to collected events, but the
check boxes for these event types are not displayed in the
configuration until you update your Windows Event Log device
plug-in.
Parameter Description
/MONITORDEST Allows you to specify the syslog destination that you want to
receive the events. The IP address you type should be the
address of your QRadar SIEM Console or Event Collector.
For example,
/MONITORDEST=10.100.100.100:514
If you do not specify a port number, the default of port 514 is
used for forwarding syslog events.
/MONITORPROTO Allows you to select the protocol to use when sending syslog
events to QRadar SIEM. The protocol can be specified as TCP
or UDP.
For example,
/MONITORPROTO=TCP
or
/MONITORPROTO=UDP
If this parameter is not defined, the Adaptive Log Exporter
service defaults to sending events using UDP.
/DEVICEADDRESS Type the hostname or IP address for the device providing the
Windows events to QRadar SIEM.
For example,
/DEVICEADDRESS=10.100.100.100
or
/DEVICEADDRESS=workstation102
or
/DEVICEADDRESS=%COMPUTERNAME%
Note: The device address field allows you to include system
variables for bulk installations of the Adaptive Log Exporter.
For example, %computername%.
Adaptive Log This section provides additional examples of using the CLI utility including:
Exporter CLI Utility • Batch File Command Line Install Script
Examples
• Full Adaptive Log Exporter Installation
• Installing the Adaptive Log Exporter Service Only
• Service Only Installation Monitoring the Windows Security Log
• Full Install Monitoring Windows Logs
source files from a Windows share, installs the Adaptive Log Exporter and the
Windows Event Plug-in, and configures the host to forward all Microsoft Windows
events to QRadar SIEM.
copy \\SERVER\SHARE\AdaptiveLogExporter_setup.exe c:\
copy \\SERVER\SHARE\ALE_WindowsEventLogPlugin_setup.exe c:\
Where <QRadar SIEM IP> is the IP address or hostname of your QRadar SIEM
Console or Event Collector.
Note: The Directory Service, DNS Server, and File Replication events are
collected by the Adaptive Log Exporter; however, the configuration interface does
not display the check boxes until after you update your device plug-ins.
Using the command for the full install requires that you update your device plug-ins
and configure devices. The above command installs the Adaptive Log Exporter
only. To fully install the Adaptive Log Exporter, including the service and the wizard
interface, type the following command:
Note: If you install the service without additional Windows Event Log parameters,
you must update your devices using the
ALE_WindowsEventLogPlugin_setup.exe. For more information, see Updating a
Windows Event Log Configuration.
The command line installs the Adaptive Log Exporter, and then configures the
Security, Application, and System logs.
After you have installed the Adaptive Log Exporter, you must complete the
following configuration steps to update your device plug-ins:
1 Configure the update site to install device plug-ins for the Adaptive Log Exporter.
If your host does not have Internet connectivity, see Configuring Updates for
Off-line Sites.
2 Optional. Configure a schedule to look for updated device plug-ins.
3 Optional. Configure preferences for future plug-in updates.
Configuring the The update site allows you to specify a download location for device plug-in files
update site required by the Adaptive Log Exporter.
Device plug-ins are important because they contain updates for parsing events
and can include new event types or event categories.
Proocedure
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 On the main menu, select File > Preferences.
Step 3 Click the + icon to expand the Install/Update navigation tree.
Step 4 On the navigation menu, select Update Site.
Step 5 In the Update Site URL field, type the location of your update site file.
For example,
• To update from the Internet, type a URL:
http://downloads.q1labs.com/windowsagent
• To update from a Windows share, type the path to your server:
file://<SOMEWINDOWSSERVER>/ALE/UpdateSite
• To update from a local file, type the path to the file:
file:///e:/UpdateSite
Note: If you choose a Windows server or local file, you must download the
ALEUpdateSite.zip file from the IBM Support website and extract the file to a
Windows share or file repository. The update site file is located at the following
address: http://www.ibm.com/support/fixcentral/. For more information, see
Configuring Updates for Off-line Sites.
Step 6 Click Apply.
Step 7 Click OK.
Step 8 On the toolbar, click Add Plugins.
Step 9 Click the + to expand the device list.
Step 10 Choose one of the following options:
a To install all available device plug-ins, select the top level check box.
b To install specific device plug-ins, select a check box for each device plug-in to
install.
Note: The Show the latest version of a feature only and the Filter features
included in other features on the list check boxes are for future development
purposes only. We recommend that you use the default values for these check
boxes.
Step 11 To install all dependent plug-ins, click Select Required.
If you selected device plug-ins that requires additional software an error can
display. Click Error Details for additional information.
Step 12 Click Next.
Step 13 Read the license associated with the selected device. To continue, you must select
the I accept the terms of the license agreement option.
Step 14 Click Next.
Note: You must install your device plug-ins to the default location.
Step 15 Click Finish.
Step 16 Click Install All to install all chosen devices.
After the device plug-in installations complete, you are ready to configure your
syslog destination. For more information, see Managing Destinations.
Configuring The Adaptive Log Exporter might be configured on a host that does not have
updates for off-line Internet connectivity.
sites
Hosts without Internet connectivity is often the case when the Adaptive Log
Exporter is used on hardened network assets. For these systems we recommend
you download and configure a local site for updating the Adaptive Log Exporter
device plug-ins.
Procedure
Step 1 From a system with Internet connectivity, download the ALEUpdateSize.zip file.
http://www.ibm.com/support/fixcentral/
Step 2 Copy the file to the Adaptive Log Exporter host or a local Windows share.
Step 3 Extract the file.
You must keep the folder and directory structure intact when you extract the
ALEUpdateSize.zip file.
Step 4 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 5 From the main menu, select File > Preferences.
Step 6 Click the + icon to expand the Install/Update navigation tree.
Step 7 From the navigation menu, select Update Site.
Step 8 In the Update Site URL field, type the location of your update site file.
For example,
• To update from a Windows share, type the path to your server:
file://<SOMEWINDOWSSERVER>/ALE/UpdateSite
• To update from a local file, type the path to the file:
file:///e:/UpdateSite
Step 9 Click Apply.
Step 10 Click OK.
Step 11 From the toolbar, click Add Plugins.
Step 12 Click the + to expand the device list.
Step 13 Choose one of the following options:
a To install all available device plug-ins, select the top level check box.
b To install specific device plug-ins, select a check box for each device plug-in to
install.
Note: The Show the latest version of a feature only and the Filter features
included in other features on the list check boxes are for future development
purposes only. We recommend that you use the default values for these check
boxes.
Step 14 To install all dependent plug-ins, click Select Required.
If you selected device plug-ins that requires additional software an error can
display. Click Error Details for additional information.
Step 15 Click Next.
The Feature License window is displayed.
Step 16 Read the license associated with the selected device. To continue, you must select
the I accept the terms of the license agreement option.
Scheduling You can configure the Adaptive Log Exporter to automatically search for device
Automatic Updates plug-in updates. Device plug-in updates are important because they often contain
event parsing updates and can include new event types or event categories.
Procedure
Step 1 From the Start menu, select Programs > AdaptiveLogExporter > Configure
Adapter Log Exporter.
Step 2 On the toolbar, select File > Preferences.
Step 3 In the navigation manu, click the + sign next to Install/Update.
Step 4 Click Automatic Updates.
Step 5 Select the Automatically find new updates and notify me check box.
Step 6 Select one of the following options to schedule automatic updates:
• Look for updates each time platform is started - Enables the system to
search for updates each time you start your Adaptive Log Exporter. This is the
default.
• Look for updates on the following schedule - Allows you to schedule a
specific time for searching for updates.
Step 7 Select one of the following options for downloading updates:
• Search for updates and notify me when they are available - Enables
notifications when device updates are available.
• Download new updates automatically and notify me when ready to install
them - Enables the system to download updates automatically and notifies you
when the updates are ready to install.
Step 8 Click Apply.
Step 9 Click OK.
The automatic update schedule is complete.
Configuring After you have updated your device plug-ins, you can define the content installed
automatic update in future device plug-in updates.
preferences
Procedure
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 From the main menu, select File > Preferences.
Step 3 Click Install/Update.
Step 4 In the Maximum number of History configurations field, type the number of
configuration changes you want the system to maintain. The default is 100.
Step 5 Select the Check digital signatures of downloaded archives check box.
By default, this check box is selected to prevent unauthorized or unsigned
signatures from being installed.
Step 6 Select one of the following update options:
• equivalent - Equivalent updates include device plug-ins that are at the same
revision level as your Adaptive Log Exporter application.
• compatible - Compatible updates include any device plug-ins that work with
your Adaptive Log Exporter regardless of the software revision of the device
plug-in.
Step 7 To define a specific update policy, specify a URL in the Policy URL field.
This update policy is useful if your deployment includes many Adaptive Log
Exporters. If this is the case, you might need to schedule event uploads to
minimize the potential high load on the network. For assistance creating a custom
update policy, contact IBM Corp. Customer Support.
Step 8 To define specific proxy settings for your updates:
a Select the Enable HTTP Proxy connection check box.
b In the HTTP proxy host address field, type the IP address of the desired proxy
host.
c In the HTTP proxy host port field, type the port number of the proxy host.
Step 9 Click Apply.
Step 10 Click OK.
Destinations in the Adaptive Log Exporter allow you to create a syslog forwarding
destination for events and map specific devices to the destination address. This
allows you to create unique destinations for each of the device plug-ins in your
network, but in most cases, you only need to map your devices directly to your
QRadar SIEM Console or Event Collector. The Adaptive Log Exporter allows you
to create three types of destinations:
• Syslog TCP - Allows you to forward syslog events using the TCP protocol on
the port of your choosing.
• Syslog UDP - Allows you to forward syslog events using the UDP protocol on
the port of your choosing.
• Logger - Allows you to log events to a local file on the Adaptive Log Exporter
host.
Configuring The destination provides the Adaptive Log Exporter with an event forwarding
destinations destination for event logs. You must configure the destination before you configure
individual device plug-ins for the Adaptive Log Exporter. These destinations are
then mapped to the device plug-in, which allows each device to forward events to
the appropriate destination.
Adding a syslog TCP The following instructions include the steps required to create a destination
destination address or log file of events for the Adaptive Log Exporter. You can create an
individual destination or multiple destinations and save them all simultaneously
from the toolbar.
As you open tabs for devices or destinations, unsaved changes display the *
character next to their name. If you select Save All from the toolbar, this saves all
open tabs with changes. Issues that prevent the tab from saving generate an error
message and the * character is still displayed on the tab.
Procedure
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Destinations tab.
The Destinations tab is displayed showing the three destination types that can be
created.
Step 3 Right-click on a destination type and select Add Destination.
Step 4 Configure the following values:
Parameter Description
Name Type the name you want to assign this destination.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Syslog Server Address Type the IP address or hostname of the syslog
destination.
The information specified in this field is typically the IP
address or hostname of your QRadar SIEM Console or
Event Collector.
Syslog Server Port Type the port number used for receiving events by the
syslog destination.
By default, QRadar SIEM Consoles and Event Collectors
listen on port 514 for TCP and UDP syslog.
Append Line Terminator Select this check box to include a line termination
character at the end of every TCP syslog event message.
Number of Threads Type the number of concurrent processing threads you
want to run in this destination. The default is 1.
Adding a syslog UDP The following instructions include the steps required to create a syslog destination
destination for UDP events. You can create an individual destination or create multiple
destinations, and then save them simultaneously from the toolbar.
As you open tabs for devices or destinations, unsaved changes display the *
character next to their name. If you select Save All from the toolbar, this saves all
open tabs with changes. Issues that prevent the tab from saving generate an error
message and the * character is still displayed on the tab.
Procedure
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Destinations tab.
The Destinations tab is displayed showing the three destination types that can be
created.
Step 3 Right-click on Syslog UDP and select Add Destination.
Step 4 Configure the following values:
Parameter Description
Name Type the name you want to assign this destination.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Syslog Server Address Type the IP address or hostname of the syslog
destination.
The information specified in this field is typically the IP
address or hostname of your QRadar SIEM Console or
Event Collector.
Syslog Server Port Type the port number used for receiving events by the
syslog destination.
By default, QRadar SIEM Consoles and Event Collectors
listen on port 514 for TCP and UDP syslog.
Number of Threads Type the number of concurrent processing threads you
want to run in this destination. The default is 1.
Adding a logger The following instructions include the steps required to create a logger destination
destination for the Adaptive Log Exporter.
Note: As you open tabs for devices or destinations, unsaved changes display the *
character next to their name. If you select Save All from the toolbar, this saves all
open tabs with changes. Issues that prevent the tab from saving generate an error
message and the * character is still displayed on the tab.
Procedure
Step 1 From the Start menu, select Start > Programs > Adaptive Log Exporter >
Configure Adapter Log Exporter.
Step 2 Click the Destinations tab.
The Destinations tab is displayed showing the three destination types that can be
created.
Step 3 Right-click on Logger and select Add Destination.
Step 4 Configure the following values:
Parameter Description
Name Type the name you want to assign this destination.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Logger Prefix Type the heading you want to assign to the logs.
The Logger Prefix must start with Device.Events and may
contain letters, numbers and periods.
Prepend syslog header Select this check box if you want the syslog header to be
attached to the message in the logs.
Number of Threads Type the number of concurrent processing threads you
want to run in this destination. The default is 1.
Procedure
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Destinations tab.
Step 3 Click the + sign to expand the menu tree for your destination.
The Adaptive Log Exporter monitors all comma-separated value log files from the
root log directory you define when configuring the device plug-in.
Before you can configure any device plug-in for the Adaptive Log Exporter, you
must complete the following steps from previous chapters:
1 Configure the Adaptive Log Exporter update site.
2 Configure a destination for your Cisco ACS events.
If these steps are complete, you are ready to configure your Cisco ACS device
plug-in and map your device to a destination.
Configuring Cisco The Cisco ACS device plug-in allows you to configure the root log directory for
ACS your comma-separated log files, configure polling options, and create a name and
IP address to identify your device. After you configure your device, you can map
your Cisco ACS to a syslog destination.
Configuring the The Adaptive Log Exporter monitors all comma-separated value log files from the
Cisco ACS device root log directory you define when configuring the device plug-in.
plug-in
Procedure
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Devices tab.
Step 3 Right click on Cisco ACS and select Add Device.
The device properties for adding new Cisco ACS device are displayed.
Step 4 Configure the following parameters:
Parameter Description
Name Type the name you want to assign this device.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Device Address Type the IP address or hostname for your Cisco ACS device.
Root Log Directory Click Browse or type the location of the Cisco ACS log files.
Cisco ACS monitors all comma-seperated value (csv) files in
the Root Log Directory.
By default, Cisco ACS log files are located in <ACS Install
Directory>\<Service Name>\Logs.
Where:
<ACS Install Directory> is the install directory of Cisco
ACS.
<Service Name> is the directory that identifies the Cisco
ACS service.
Note: Do not use the Cisco ACS device plug-in to monitor
files that can only be accessed over the network, such as a
file share.
Throttle timeout Type the delay between polling events, in milliseconds, for
the Cisco ACS device. The default throttle timeout is 500
milliseconds. The minimum value is 10 milliseconds.
The higher the value specified in the throttle timeout means
that the Adaptive Log Exporter checks for updated device
logs less often. The lower the value specified in the throttle
timeout means that the Adaptive Log Exporter checks for
updated device logs more often.
Creating a device After you have configured your device, you must map your device to a destination.
mapping
Procedure
Step 1 Click the Destinations tab.
Step 2 Click + to expand the available destinations.
If no + exists, you need to create a destination. For more information, see
Configuring Destinations.
Step 3 Right-click on a destination and select Add Device Mapping.
Step 4 A list of configured devices is displayed.
Before you can configure any device plug-in for the Adaptive Log Exporter, you
must complete the following steps from previous chapters:
1 Configure the Adaptive Log Exporter update site.
2 Configure a destination for your Cisco CSA events.
If these steps are complete, you are ready to configure your Cisco CSA device
plug-in and map your device to a destination.
Configuring Cisco The Cisco CSA device plug-in allows you to configure the root log directory for
CSA your active alert file, configure polling options, and create a name and IP address
to identify your device. After you configure your device, you can map your Cisco
CSA to a syslog destination.
Configuring the To configure your Cisco CSA in the Adaptive Log Exporter:
Cisco CSA Device
Plug-in
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Devices tab.
Step 3 Right-click on Cisco CSA and select Add Device.
The device properties for adding a new Cisco CSA device are displayed.
Parameter Description
Name Type the name you want to assign this device.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Device Address Type the IP address or hostname for your Cisco CSA device.
Root Log Directory Click Browse or type the location of the CSA MC alert log
files. By default, the CSA alert log files are located in the
following directory:
C:\alerts\
Note: Do not use the Cisco CSA device plug-in to monitor
files that can only be accessed over the network, such as a
file share.
Log Filename Type the name of the active alert log file. The Adaptive Log
Exporter monitors this log file for events. The default value for
the log file is logfile.txt.
Events are written to the active alert log file as a UTF-8
encoded text file in the Root Log Directory.
Note: This file data is encoded in UTF-8 format. Entry fields
are separated by a comma. Event entries are separated by a
carriage return/line feed (ASCII Hex 0D 0A). After a log file
exceeds 1 MB in size, the file is closed and the file name is
suffixed with a time stamp. A new file, using the same file
name entered in the CSA MC Alerts Log file field, is then
created. Events continue to be written to this new file until it
reaches 1 MB.
Throttle timeout Type the delay between polling events, in milliseconds, for
the Cisco CSA device. The default throttle timeout is 500
milliseconds. The minimum value is 10 milliseconds.
The higher the value specified in the throttle timeout indicates
that the Adaptive Log Exporter checks for updated device
logs less often. The lower the value specified in the throttle
timeout indicates that the Adaptive Log Exporter checks for
updated device logs more often.
Creating a Device After you have configured your device, you must map your device to a destination.
Mapping
Procedure
Step 1 Click the Destinations tab.
Step 2 Click + to expand the available destinations.
If no + exists, you need to create a destination. For more information, see
Configuring Destinations.
Step 3 Right-click on a destination and select Add Device Mapping.
Step 4 A list of configured devices is displayed.
Step 5 Select your Cisco CSA device.
A mapping is created for your Cisco CSA device to the destination.
Step 6 Click Save.
Step 7 Click Deploy.
After the deploy process completes your events are forwarded from the Adaptive
Log Exporter to QRadar SIEM. These events are automatically discovered and
added as a log source using the name and IP address of your Cisco CSA device.
Step 8 Repeat this process to map additional Cisco CSA devices.
The Cisco CSA configuration is complete.
The File Forwarder plug-in allows you to take an event log from an unsupported
device or log type and forward the events to QRadar SIEM. The log files read by
the File Forwarder device plug-in must be text based, single-line events. Multi-line
events are not supported. After you configure the File Forwarded plug-in to forward
the events to QRadar SIEM, you can create a Universal DSM to parse and
categorize events.
We recommend you configure the File Forwarder device plug-in to use unique
values of the Starts With and Ends With fields, if:
• Multiple devices are writing log files to the same root log directory.
• Your root log directory contains a mix of log files from devices that use the
Continuously Monitor Files check box differently.
CAUTION
If a log file is copied to the Root Log Directory and overwrites an existing file, the
events in the new file might not be properly forwarded to QRadar SIEM. The File
Forwarder plug-in is intended to monitor existing files being appended or newly
created event log files.
Before you can configure any device plug-in for the Adaptive Log Exporter, you
must complete the following steps from previous chapters:
1 Configure the Adaptive Log Exporter update site. For more information, see
Configuring the Update Site.
2 Configure a destination for your File Forwarder events. For more information, see
Configuring Destinations.
If these steps are complete, you are ready to configure your Cisco CSA device
plug-in and map your device to a destination.
Configuring a File The File Forwarder device plug-in allows you to configure the root log directory for
Forwarder your file, select the starting and ending file identifiers, and create a name and IP
address to identify your device. After you configure your device, you can map your
File Forwarder to a syslog destination.
Configuring the File To configure a file forwarder in the Adaptive Log Exporter:
Forwarder Device
Plug-in
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Devices tab.
Step 3 Right-click on File Forwarder and select Add Device.
The device properties for a adding new File Forwarder device are displayed.
Step 4 Configure the following parameters:
Parameter Description
Name Type the name you want to assign this device.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Device Address Type the IP address or hostname for your File Forwarder
device.
Root Log Directory Click Browse or type the location of the log files to forward to
QRadar SIEM.
Note: Do not use the File Forwarder device plug-in to monitor
files that can only be accessed over the network, such as a
file share.
Parameter Description
Starts with Select this check box and type a pattern to define a specific
character combination matching the first letters or numbers \
in the name of your log file. This field allows you to select a
specific log file from a directory that can contain several other
log file types.
For example, if you have a directory containing log files
labeled IPv4.log and IPv6.log, this field allows you to select all
files starting with IPv4. To select only IPv4 files for forwarding,
type IPv4 in the Starts With field.
This string can be up to 255 characters in length and does not
support wildcard (*) characters.
Ends with Select this check box and type a pattern to define a specific
character combination matching the end of your log file. This
field allows you to select a specific log file from a directory
that can contain several other log file types.
For example, to monitor all files ending in .log, type .log as
the value in the Ends With field.
This string can be up to 255 characters in length and does not
support wildcard (*) characters.
Only Monitor Files Select this check box if you only want to monitor files with a
Created Today creation date matching the current date.
The Adaptive Log Exporter evaluates the root log directory for
files created today when a change to the root log directory
occurs. For example, new files are created or deleted.
Continuously Monitor Select or clear the check box.
Files • If the check box is selected, log files in the root log
directory are continually monitored for changes in file size.
When a new log file is written to the root log directory, the
log file is processed when an increase in the file size is
detected. After the file size change is detected, all lines of
the log file are processed. The processed events are
forwarded to QRadar SIEM.
Existing log files in the root log directory are monitored and
processed every time an increase in the file size is
detected. New lines that have been added to the file since
the last time the file was processed are forwarded to
QRadar SIEM.
• If the check box is clear, new log files created in the root
log directory are read once and processed. Further
changes to the log file are ignored.
Parameter Description
Throttle timeout Type the delay between polling events, in milliseconds, for
the File Forwarder plug-in. The default throttle timeout is 500
milliseconds. The minimum value is 10 milliseconds.
The higher the value specified in the throttle timeout means
that the Adaptive Log Exporter checks for updated device
logs less often. The lower the value specified in the throttle
timeout means that the Adaptive Log Exporter checks for
updated device logs more often.
Creating a Device After you have configured your device, you must map your device to a destination.
Mapping
To map a device to a destination:
Step 1 Click the Destinations tab.
Step 2 Click + to expand the available destinations.
If no + exists, you need to create a destination. For more information, see
Configuring Destinations.
Step 3 Right-click on a destination and select Add Device Mapping.
Step 4 A list of configured devices is displayed.
Step 5 Select your File Forwarder device.
A mapping is created for your File Forwarder to the destination.
Step 6 Click Save.
Step 7 Click Deploy.
After the deploy process completes your events are forwarded from the Adaptive
Log Exporter to QRadar SIEM. These events are automatically discovered and
added as a log source using the name and IP address of your File Forwarder
device.
Step 8 Repeat this process to map additional File Forwarder devices.
The File Forwarder configuration is complete for the Adaptive Log Export.
However, events from your File Forwarder device plug-in are categorize as generic
events by QRadar SIEM. You can create a Universal DSM to parse and
categorized these events.
The XML File Forwarder plug-in allows the Adaptive Log Exporter to monitor
XML-based log files and forward specific data from the event logs to QRadar
SIEM. XML files are read by identifying element tags within the XML file that
contain the event payload. The Adaptive Log Explorer monitors changes to the
root log directory for XML files with names matching the specified starts with or
ends with text pattern.
We recommend you configure the XML File Forwarder device plug-in to use
unique values of the Starts With and Ends With fields, if:
• Multiple devices are writing log files to the same root log directory.
• Your root log directory contains a mix of log files from devices that use the
Continuously Monitor Files check box differently.
CAUTION
If a log file is copied to the Root Log Directory and overwrites an existing file, the
events in the new file might not be properly forwarded to QRadar SIEM. The XML
File Forwarder plug-in is intended to monitor existing files being appended or
newly created XML event log files.
Before you can configure any device plug-in for the Adaptive Log Exporter, you
must complete the following steps from previous chapters:
1 Configure the Adaptive Log Exporter update site. For more information, see
Configuring the Update Site.
2 Configure a destination for your File Forwarder events. For more information, see
Configuring Destinations.
If these steps are complete, you are ready to configure your XML File Forwarder
device plug-in and map your device to a destination.
Configuring an The XML File Forwarder device plug-in allows you to monitor an XML file for
XML File Forwarder specific XML element tags containing your event payload. You can configure the
root log directory for your file, select the starting and ending XML file identifiers,
and define the element tags that contain your events. After you configure your
device, you can map your XML File Forwarder to a syslog destination.
Configuring the XML To configure an XML file forwarder in the Adaptive Log Exporter:
File Forwarder
Device Plug-in
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Devices tab.
Step 3 Right-click on XML File Forwarder and select Add Device.
The device properties for adding a new File Forwarder device are displayed.
Step 4 Configure the following parameters:
Parameter Description
Name Type the name you want to assign this device.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Device Address Type the IP address or hostname for your XML File
Forwarder device.
Root Log Directory Click Browse or type the location of your XML log files.
Note: Do not use the XML File Forwarder device plug-in to
monitor files that can only be accessed over the network,
such as a file share.
Starts with Select this check box and type a pattern to define a specific
character combination matching the first letters or numbers \
in the name of your log file. This field allows you to select a
specific log file from a directory that can contain several other
log file types.
For example, if you have a directory containing log files
labeled IPv4.log and IPv6.log, this field allows you to select all
files starting with IPv4. To select only IPv4 files for forwarding,
type IPv4 in the Starts With field.
This string can be up to 255 characters in length and does not
support wildcard (*) characters.
Parameter Description
Ends with Select this check box and type a pattern to define a specific
character combination matching the end of your log file. This
field allows you to select a specific log file from a directory
that can contain several other log file types.
For example, to monitor all files ending in .log, type .log as
the value in the Ends With field.
This string can be up to 255 characters in length and does not
support wildcard (*) characters.
Only Monitor Files Select this check box if you only want to monitor files with a
Created Today creation date matching the current date.
The Adaptive Log Exporter evaluates the root log directory for
files created today when a change to the root log directory
occurs. For example, new files are created or deleted.
Main Element Tag Type the XML element that is considered an event. This
element and all of the associated child elements are
processed.
Translate Element Type the translators required to correctly parse the XML
Tag element. This field allows you to substitute an element with
another text value that is easier to parse.
For example,
<dot-separated XML element path> =
<replacement text>
All elements containing this path are replaced with the
corresponding text. This can be used to shorten the payload
length. For example:
LogEntry.MessageHeader = Hdr
This results in Hdr replacing occurrences of
LogEntry.MessageHeader.
All fields are matched using the longest algorithm first and
then shorter algorithms are attempted after a match is found.
Ignore Empty Select this check box to ignore elements that contain empty
Elements values. Elements that does not have an associated value are
not inserted into the payload.
For example, elements that resemble x.y.z = with no data are
not inserted into the payload.
Parameter Description
Continuously Monitor Select or clear the check box.
Files • If the check box is selected, log files in the root log
directory are continually monitored for changes in file size.
When new log files are written to the root log directory, the
XML files are processed when an increase in the file size is
detected. After the file size change is detected, all lines of
the XML file are processed. The processed events are
forwarded to QRadar SIEM.
Existing log files in the root log directory are monitored and
processed every time an increase in the file size is
detected. New lines that have been added to the file since
the last time the file was processed are forwarded to
QRadar SIEM.
• If the check box is clear, new log files created in the root
log directory are read once and processed. Further
changes to the log file are ignored.
Throttle timeout Type the delay between polling events, in milliseconds, for
the XML File Forwarder plug-in. The default throttle timeout is
500 milliseconds. The minimum value is 10 milliseconds.
The higher the value specified in the throttle timeout means
that the Adaptive Log Exporter checks for updated device
logs less often. The lower the value specified in the throttle
timeout means that the Adaptive Log Exporter checks for
updated device logs more often.
You are now ready to map your File Forwarder device to a syslog destination.
Creating a Device After you have configured your device, you must map your device to a destination.
Mapping
To map a device to a destination:
Step 1 Click the Destinations tab.
Step 2 Click + to expand the available destinations.
If no + exists, you need to create a destination. For more information, see
Configuring Destinations.
Step 3 Right-click on a destination and select Add Device Mapping.
Step 4 A list of configured devices is displayed.
Step 5 Select your XML File Forwarder device.
A mapping is created for your XML File Forwarder to the destination.
Step 6 Click Save.
Step 7 Click Deploy.
After the deploy process completes your events are forwarded from the Adaptive
Log Exporter to QRadar SIEM. These events are automatically discovered and
added as a log source using the name and IP address of your File Forwarder
device.
Step 8 Repeat this process to map additional XML File Forwarder devices.
The File Forwarder configuration is complete for the Adaptive Log Export.
However, events from your XML File Forwarder device plug-in are categorize as
generic events by QRadar SIEM. You can create a Universal DSM to parse and
categorized these events.
The Juniper Steel-Belted Radius (SBR) plug-in for the Adaptive Log Exporter
allows you to collect logs for the Juniper Steel-Belted Radius appliance and
forward the events to QRadar SIEM. The Adaptive Log Exporter must be installed
on the same host as Juniper SBR. The Adaptive Log Exporter must be updated to
include the latest Juniper SBR device plug-in.
Before you can configure any device plug-in for the Adaptive Log Exporter, you
must complete the following steps from previous chapters:
1 Configure the Adaptive Log Exporter update site. For more information, see
Configuring the Update Site.
2 Configure a destination for your Juniper SBR events. For more information, see
Configuring Destinations.
If these steps are complete, you are ready to configure your Juniper SBR device
plug-in and map your device to a destination.
Configuring The Juniper SBR device plug-in allows you to configure the root log directory for
Juniper your comma-separated event log file, configure polling options, and create a name
Steel-Belted Radius and IP address to identify your device. After you configure your device, you can
map your Juniper SBR to a syslog destination.
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Devices tab.
Parameter Description
Name Type the name you want to assign this device.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Device Address Type the IP address or hostname for your Juniper SBR
device.
Root Log Directory Click Browse or type the location of the Juniper SBR log files.
The Adaptive Log Exporter monitors the root log directory for
any comma-separated value (.csv) files with a file name
containing a date stamp matching the current day.
Report log files should be located in the following Steel-Belted
Radius directory:
<radiusdir>\authReports
Note: The Juniper SBR device must have the authReport.ini
initialization file configured to generate the following log files
in the root log directory:
• Authentication acceptance report - The file in the root
log directory must match accepts_yyyymmdd.csv.
• Authentication rejection report - The file in the root log
directory must match rejects_yyyymmdd.csv.
• Unknown authentication client report - The file in the
root log directory must match
unknownClient_yyyymmdd.csv.
• Invalid shared secret report - The file in the root log
directory must match badSharedSecret_yyyymmdd.csv.
Note: Do not use the Juniper SBR device plug-in to monitor
files that can only be accessed over the network, such as a
file share.
Throttle timeout Type the delay between polling events, in milliseconds, for
the device. The default throttle timeout is 500 milliseconds.
The minimum value is 10 milliseconds.
The higher the value specified in the throttle timeout indicates
that the Adaptive Log Exporter checks for updated device
logs less often. The lower the value specified in the throttle
timeout indicates that the Adaptive Log Exporter checks for
updated device logs more often.
Step 6 Repeat this process to create and configure additional Juniper SBR device
plug-ins.
You are now ready to map your Juniper Steel-Belted Radius device to a syslog
destination.
Creating a Device After you have configured your device, you must map your device to a destination.
Mapping
To map a device to a destination:
Step 1 Click the Destinations tab.
Step 2 Click + to expand the available destinations.
If no + exists, you need to create a destination. For more information, see
Configuring Destinations.
Step 3 Right-click on a destination and select Add Device Mapping.
Step 4 A list of configured devices is displayed.
Step 5 Select your Juniper SBR device.
A mapping is created for your Juniper SBR device to the destination.
Step 6 Click Save.
Step 7 Click Deploy.
After the deploy process completes your events are forwarded from the Adaptive
Log Exporter to QRadar SIEM. These events are automatically discovered and
added as a log source using the name and IP address of your Juniper SBR device.
Step 8 Repeat this process to map additional Juniper SBR devices.
The Juniper SBR configuration is complete.
The NetApp Data ONTAP device plug-in allows you to audit your NetApp storage
device by monitoring audit events from the Data ONTAP operating system. The
NetApp Data ONTAP device plug-in monitors event log files in the Remote Log
Directory and copies the event log files to a local directory for processing. The
processed events are then forwarded to QRadar SIEM as syslog events.
You must configure the Adaptive Log Exporter service with NetApp Data ONTAP
administrative user credentials. The user account must have read privileges to the
Remote Log Directory and Local Temporary Directory. For more information, see
Configuring Adaptive Log Exporter Service Credentials.
CAUTION
The NetApp Data ONTAP plug-in only supports the Common Internet File System
(CIFS) protocol.
Before you can configure any device plug-in for the Adaptive Log Exporter, you
must complete the following steps from previous chapters:
1 Configure the Adaptive Log Exporter update site. For more information, see
Configuring the Update Site.
2 Configure a destination for your NetApp Data ONTAP events. For more
information, see Configuring Destinations.
If these steps are complete, you are ready to configure your NetApp device plug-in
and map your device to a destination.
Configuring The NetApp device plug-in allows you to configure the root log directory for your
NetApp Data event (.evt) files, configure polling options, and create a name and IP address to
ONTAP identify your device. After you configure your device, you can map your NetApp
Data ONTAP to a syslog destination.
Configuring the To configure your NetApp device in the Adaptive Log Exporter:
NetApp Data ONTAP
Device Plug-in
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Devices tab.
Step 3 Right-click on NetApp and select Add Device.
The device properties for adding a new NetApp device is displayed.
Step 4 Configure the following parameters:
Parameter Description
Name Type the name you want to assign this device.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Device Address Type the IP address or hostname for your NetApp Data
ONTAP device.
Root Log Directory Click Browse or type the directory location for your NetApp
Data ONTAP log files. The following directory location is the
default directory for storing NetApp Data ONTAP event files:
/etc/log
QRadar SIEM monitors the directory for Event (.evt) files.
Event files in the Remote Log Directory are processed if the
time and date stamp of the event file is newer than the last
scan time of the plug-in.
If you are using Windows 2008 Server, Windows Vista, or
Windows 7, the Adaptive Log Exporter converts .evt files in
the Remote Log Directory to the .evtx format using the
wevtutil.exe utility, which is included with your operating
system. For more information on using wevutil.exe, see your
Microsoft Operating System documentation.
Note: Do not use the NetApp device plug-in to monitor files
that can only be accessed over the network, such as a file
share.
Parameter Description
Local Temporary Type the directory location where the NetApp plug-in copies
Directory event files. After an event file is copied from the specified
location, the event file is processed and deleted from the
temporary directory.
Remote Directory Poll Type the delay between polling events, in seconds, for the
Interval (seconds) NetApp device. The minimum polling interval is 60 seconds.
The larger the value specified in the throttle timeout means
that the Adaptive Log Exporter checks for updated device
logs less often. The lower the value specified in the throttle
timeout means that the Adaptive Log Exporter checks for
updated device logs more often.
Enable EPS Throttle Select this check box to enable EPS throttling and type the
maximum number of events the NetApp plug-in allowed to
forward to QRadar SIEM every second.
By default, EPS throttle is disabled.
Note: EPS Throttling does not delay the processing of the
events, but does queue NetApp events in memory for delivery
to QRadar SIEM. If you enable EPS throttling, we recommend
that you carefully tune your configuration. If events are
generated at a greater rate than the events are forwarded,
events may be dropped.
Creating a Device After you have configured your device, you must map your device to a destination.
Mapping
To map a device to a destination:
Step 1 Click the Destinations tab.
Step 2 Click + to expand the available destinations.
If no + exists, you need to create a destination. For more information, see
Configuring Destinations.
Step 3 Right-click on a destination and select Add Device Mapping.
Step 4 A list of configured devices is displayed.
Step 5 Select your NetApp Data ONTAP device.
A mapping is created for your NetApp Data ONTAP device to the destination.
Step 6 Click Save.
Step 7 Click Deploy.
After the deploy process completes your events are forwarded from the Adaptive
Log Exporter to QRadar SIEM. These events are automatically discovered and
added as a log source using the name and IP address of your NetApp Data
ONTAP device.
Step 8 Repeat this process to map additional NetApp Data ONTAP devices.
The NetApp Data ONTAP configuration is complete.
CAUTION
Windows Event Log files can contain payloads larger than 1024 bytes, which is
the maximum payload size for the UDP protocol. We recommend that you
configure a TCP syslog destination for Windows Event Log device plug-ins
reporting events for Windows 2008 Server.
The Microsoft Windows Event Log can record the following event logs:
• Application Logs
• Security Logs
• System Logs
• Directory service logs
• DNS Server Logs
• File Replication Service Logs
NOTE
The Adaptive Log Exporter might not display check boxes for Directory Service
Logs, DNS Server Logs, or File Replication Service Logs if you have not updated
your device plug-ins. For more information, see Configuring the Update Site.
When accessing Windows Event Logs on a remote machine using the Remote
Machine field, you must specify a user account with administrative privileges for
the Adaptive Log Exporter service. Domain administrative privileges might be
required if you are remotely accessing logs located on domain controllers. The
Adaptive Log Exporter service uses these credentials to retrieve log files from
remote sources. For more information, see Configuring Adaptive Log Exporter
Service Credentials.
Before you can configure any device plug-in for the Adaptive Log Exporter, you
must complete the following steps from previous chapters:
1 Configure the Adaptive Log Exporter update site. For more information, see
Configuring the Update Site.
2 Configure a destination for your Windows Event Log events. For more information,
see Configuring Destinations.
If these steps are complete, you are ready to configure your Windows Event Log
device plug-in and map your device to a destination.
Configuring The Windows Event Log device plug-in allows you to configure the events logs to
Windows Event collect using check boxes. Selecting a check box allows the Windows Event Log
Log device plug-in to request the information for the local or remote Windows host
using an application programming interface (API). You can configure polling
options, collect events from remote Windows hosts, and create a name and IP
address to identify your device. After you configure your device, you can map your
Windows Event Log device to a syslog destination.
Configuring the To configure your Microsoft Event Log device in the Adaptive Log Exporter:
Windows Event Log
Device Plug-in
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Devices tab.
Step 3 Right-click on Windows Event Log and select Add Device.
The device properties for adding a new Windows Event Log device are displayed.
Step 4 Configure the following parameters:
Parameter Description
Name Type the name you want to assign this device.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Parameter Description
Device Address Type the IP address or hostname for your local or remote
Windows host.
Note: You only need to specify a remote IP address or
hostname when using the Remote Machine check box.
Windows Event Log Configuration
Application Log Select this check box if you want the device to monitor the
application log.
The application log contains events logged by programs. For
example, a database program may record a file error in the
application log. The specific events recorded by the
application log are determined by the software program.
Security Log Select this check box if you want the device to monitor the
security log.
The security log records security-based events, such as, valid
and invalid logon attempts, creating files, opening files, or
deleting files from the network.
You must have administrator privileges or be a member of the
administrators group to enable, use, and specify which events
you want to record in the security log.
System Log Select this check box if you want the device to monitor the
system log.
The system log contains events logged by Windows XP
system components. For example, if a driver fails to load
during startup, an event is recorded in the system log. The
operating system contains a predetermined list of events that
are logged by system components.
Directory Service Log Select this check box if you want the device to monitor the
directory service log file.
The directory service log contains events logged by the Active
Directory domain controller.
DNS Server Log Select this check box if you want the device to monitor the
Domain Name Service (DNS) server log file.
The DNS server log file contain events related to the
resolution of DNS names to IP addresses.
File Replication Log Select this check box if you want the device to monitor the file
replication service log file.
The file replication log tracks replication between domain
controllers.
Parameter Description
Remote Machine Select this check box and type the path to the remote
machine to allow the Adaptive Log Exporter to retrieve
Windows Event Logs from a remote machine. The path must
be specified using a Universal Naming Convention (UNC)
name.
For example, \\host123 or \\172.16.20.98.
The Remote Machine field can include up to 255 characters.
Note: The Adaptive Log Exporter Service must be configured
with the correct permission level to read WIndows Event Logs
from a remote Windows host. You must provide Domain
Administrator credentials to the Adaptive Log Exporter
service. For more information, see Configuring Adaptive
Log Exporter Service Credentials.
Polling Interval Type the delay between polling for events, in milliseconds,
from a remote machine containing Windows Event Logs. The
default polling interval is 5000 milliseconds.
The higher the value specified in the throttle timeout means
that the Adaptive Log Exporter checks for updated Windows
Event Logs on the remote machine less often. The lower the
value specified in the throttle timeout means that the Adaptive
Log Exporter checks the remote machine for updated
Windows Event Logs more often.
Advanced Configuration
Throttle timeout Type the delay between polling events, in milliseconds, for
the Windows Event Log device. The default throttle timeout is
500 milliseconds. The minimum value is 10 milliseconds.
The higher the value specified in the throttle timeout means
that the Adaptive Log Exporter checks for updated device
logs less often. The lower the value specified in the throttle
timeout means that the Adaptive Log Exporter checks for
updated device logs more often.
Creating a Device After you have configured your device, you must map your device to a destination.
Mapping
To map a device to a destination:
Step 1 Click the Destinations tab.
Step 2 Click + to expand the available destinations.
In the Microsoft Windows Server suite, DHCP server log files use audit logging to
permit log files to remain enabled without additional monitoring or administration.
This allows you to manage log file growth or conserve disk resources.
Before you can configure any device plug-in for the Adaptive Log Exporter, you
must complete the following steps from previous chapters:
1 Configure the Adaptive Log Exporter update site. For more information, see
Configuring the Update Site.
2 Configure a destination for your Windows DHCP Server events. For more
information, see Configuring Destinations.
If these steps are complete, you are ready to configure your Windows DHCP
device plug-in and map your device to a destination.
Configuring a The Windows DHCP device plug-in allows you to configure the root log directory
Microsoft DHCP for your DHCP log files, configure polling options, and create a name and IP
Device address to identify your device. After you configure your device, you can map your
Windows DHCP device to a syslog destination.
Configuring the To configure your Microsoft DHCP device in the Adaptive Log Exporter:
Windows DHCP
Device Plug-in
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Devices tab.
Step 3 Right-click on Windows DHCP and select Add Device.
The device properties for adding a new Windows DHCP device are displayed.
Step 4 Configure the following parameters:
Parameter Description
Name Type the name you want to assign this device.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Device Address Type the IP address or hostname for your DHCP Server.
Root Log Directory Click Browse or type the directory location for your Windows
DHCP log files.
The Windows DHCP plug-in monitors the Root Log Directory
for DhcpSrvLog and DhcpV6SrvLog log files to be modified.
The day of the week specified in the file name determines the
current log file. Windows DHCP audit log files are stored in
the following directory:
<windir>\system32\dhcp\DhcpSrvLog-xxx.log
Where <windir> is the drive letter and directory path of
Windows, such as c:\Windows.
Note: Do not use the Microsoft DHCP device plug-in to
monitor files that can only be accessed over the network,
such as a file share.
Throttle timeout Type the delay between polling events, in milliseconds, for
the Windows DHCP device. The default throttle timeout is 500
milliseconds. The minimum value is 10 milliseconds.
The higher the value specified in the throttle timeout means
that the Adaptive Log Exporter checks for updated device
logs less often. The lower the value specified in the throttle
timeout means that the Adaptive Log Exporter checks for
updated device logs more often.
Creating a Device After you have configured your device, you must map your device to a destination.
Mapping
Before you can configure any device plug-in for the Adaptive Log Exporter, you
must complete the following steps from previous chapters:
1 Configure the Adaptive Log Exporter update site. For more information, see
Configuring the Update Site.
2 Configure a destination for your Trend Micro InterScan VirusWall events. For more
information, see Configuring Destinations.
If these steps are complete, you are ready to configure your Trend Micro InterScan
VirusWall device plug-in and map your device to a destination.
Configuring an The Trend Micro InterScan VirusWall device plug-in allows you to configure the
Trend Micro Device root log directory for system and virus log files, configure polling options, and
create a name and IP address to identify your device. After you configure your
device, you can map your Trend Micro InterScan VirusWall device to a syslog
destination.
Configuring the To configure your Trend Micro InterScan VirusWall device plug-in:
Trend Micro
InterScan VirusWall
Device Plug-in
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Devices tab.
Step 3 Select Trend Micro InterScan VirusWall, right-click and select Add Device.
The device properties for adding new Trend Micro device is displayed.
Step 4 Configure the following parameters:
Parameter Description
Name Type the name you want to assign this device.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Device Address Type the IP address or hostname for your Trend Microsoft
InterScan VirusWall device.
Root Log Directory Click Browse or type the location of your Trend Micro
InterScan VirusWall log files. The Adaptive Log Exporter
monitors the log files for changes having a creation date
matching the current day of the week.
By default, the VirusWall log files are located in the following
directory:
<installation folder>\Log directory
or
Program Files\InterScan\logs
The <installation folder> is the folder in which you
installed your InterScan VirusWall device.
Note: Do not use the Trend Micro InterScan VirusWall device
plug-in to monitor files that can only be accessed over the
network, such as a file share.
Throttle timeout Type a value to indicate the delay between polling for new
events, in milliseconds, for the Trend Micro device.
The default throttle timeout is 500 milliseconds. The minimum
throttle timeout is 10 milliseconds.
The higher the value specified in the throttle timeout means
that the Adaptive Log Exporter checks for updated device
logs less often. The lower the value specified in the throttle
timeout means that the Adaptive Log Exporter checks for
updated device logs more often.
Creating a Device After you have configured your device, you must map your device to a destination.
Mapping
To map a device to a destination:
Step 1 Click the Destinations tab.
Step 2 Click + to expand the available destinations.
If no + exists, you need to create a destination. For more information, see
Configuring Destinations.
Step 3 Right-click on a destination and select Add Device Mapping.
Step 4 A list of configured devices is displayed.
Step 5 Select your Trend Micro InterScan VirusWall device.
A mapping is created for your Trend Micro InterScan VirusWall device to the
destination.
Step 6 Click Save.
Step 7 Click Deploy.
After the deploy process completes your events are forwarded from the Adaptive
Log Exporter to QRadar SIEM. These events are automatically discovered and
added as a log source using the name and IP address of your Trend Micro
InterScan VirusWall device.
Step 8 Repeat this process to map additional Trend Micro InterScan VirusWall devices.
The Trend Micro InterScan VirusWall configuration is complete.
The Microsoft Exchange Server device allows you to forward Outlook Web Access
(OWA) or SMTP logs to the Adaptive Log Exporter. The Microsoft Exchange
Server device plug-in can read OWA and SMTP event logs to collect the following
Outlook events:
• E-mail events
• Calendar events
• Contact events
• Tasks events
• Mobile and web-based access event
• Data storage events
NOTE
For more information on the Microsoft Exchange Protocol, see the Configuring
DSMs Guide.
Before you can configure any device plug-in for the Adaptive Log Exporter, you
must complete the following steps from previous chapters:
1 Configure the Adaptive Log Exporter update site. For more information, see
Configuring the Update Site.
2 Configure a destination for your Windows Exchange Server events. For more
information, see Configuring Destinations.
If these steps are complete, you are ready to configure your Windows Exchange
Server to create and forward event logs.
Configuring The Adaptive Log Exporter reads Outlook Web Access (OWA) logs from the
Microsoft location specified in the Microsoft Internet Information Service (IIS) for your
Exchange OWA Exchange Server 2003 or Exchange Server 2007. Before you can configure the
Adaptive Log Exporter, you must enable logging using Microsoft Internet
Information Services (IIS).
NOTE
The Adaptive Log Exporter supports OWA logs from Microsoft Exchange 2003
and Microsoft Exchange 2007. For more information on supported versions, see
Table 10-1.
Enabling Exchange Event logs for Microsoft Exchange are logged by Microsoft Internet Information
OWA Logs using IIS Services (IIS). You must configure and enable event logging in Microsoft IIS before
6.x you can configure the Microsoft Exchange device plug-in.
Enabling Exchange The following steps allow you to configure Microsoft IIS to create logs for your
OWA Logs using IIS Microsoft Exchange Server. After you complete these steps, you can configure the
7.x Adaptive Log Exporter plug-in for Microsoft Exchange.
Configuring the To configure your Microsoft Exchange Server OWA device in the Adaptive Log
Microsoft Exchange Exporter:
Server OWA Plug-in
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Devices tab.
Step 3 Right-click on Microsoft Exchange Server OWA Logs and select Add Device.
The device properties for adding a new Microsoft Exchange Server are displayed.
Step 4 Configure the following parameters:
Parameter Description
Name Type the name you want to assign this device.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Device Address Type the IP address or hostname for your Microsoft
Exchange Server.
Root Log Directory Click Browse or type the directory location for your Microsoft
Exchange log files.
The Microsoft Exchange Server OWA Log plug-in monitors
recently created files in the root log directory that match the
following format:
• Files starting with (u_)ex, (u_)nc, or (u_)in
• Files ending with .log
The following directory location is the default directory for
storing Windows IIS audit log files:
<windir>\System32\Log Files\W3SVC1
Where <windir> is the drive letter and directory path of
Windows, such as c:\Windows.
Note: Do not use the Microsoft Exchange Server OWA Log
device plug-in to monitor files that can only be accessed over
the network, such as a file share.
Throttle timeout Type the delay between polling events, in milliseconds, for
the Windows Event Log device. The default throttle timeout is
500 milliseconds. The minimum value is 10 milliseconds.
The higher the value specified in the throttle timeout means
that the Adaptive Log Exporter checks for updated device
logs less often. The lower the value specified in the throttle
timeout means that the Adaptive Log Exporter checks for
updated device logs more often.
Step 6 Repeat this process to create and configure additional Microsoft Exchange Service
device plug-ins.
You are now ready to map your Microsoft Exchange Service OWA Log device to a
syslog destination.
Creating a Device After you have configured your device, you must map your device to a destination.
Mapping
To map a device to a destination:
Step 1 Click the Destinations tab.
Step 2 Click + to expand the available destinations.
If no + exists, you need to create a destination. For more information, see
Configuring Destinations.
Step 3 Right-click on a destination and select Add Device Mapping.
Step 4 A list of configured devices is displayed.
Step 5 Select your Microsoft Exchange OWA device.
A mapping is created for your Microsoft Exchange OWA device to the destination.
Step 6 Click Save.
Step 7 Click Deploy.
After the deploy process completes your events are forwarded from the Adaptive
Log Exporter to QRadar SIEM. These events are automatically discovered and
added as a log source using the name and IP address of your Microsoft Exchange
OWA device.
Step 8 Repeat this process to map additional Microsoft Exchange OWA devices.
The Microsoft Exchange OWA device configuration is complete.
Forwarding The Adaptive Log Exporter reads SMTP logs from the location specified in the
Microsoft Microsoft Internet Information Service (IIS) for your Exchange Server 2003. Before
Exchange SMTP you can configure the Adaptive Log Exporter, you must enable logging using
Logs Microsoft Internet Information Services (IIS).
NOTE
The Adaptive Log Exporter supports SMTP logs only from Microsoft Exchange
2003 Servers. For more information on supported versions, see Table 10-1.
Enabling Microsoft To enable logs using Internet Information Services (IIS) for Microsoft Exchange:
Exchange 2003 SMTP
Logs
Step 1 In the Exchange System Manager menu tree, expand Servers > Protocols >
SMTP.
Step 2 Right-click Default SMTP Virtual Server and select Properties.
The Default SMTP Virtual Server Properties window is displayed.
Step 3 On the General tab, select the Enable logging check box.
Step 4 From the Active Log Format list box, select one of the following options:
• NCSA (Go toStep 8)
• IIS (Go toStep 8)
• W3C (Go toStep 5)
Step 5 Click Properties.
The W3C Properties window is displayed.
Step 6 Click the Advanced tab.
Step 7 From the list of properties, select all properties that you want to apply to the
Microsoft Exchange Server SMTP log. You must select the following check boxes:
• Method (cs-method)
• Protocol Version (cs-version)
Step 8 Click OK.
You are now ready to configure the Adaptive Log Exporter plug-in for Microsoft
Exchange Server SMTP Logs. For more information, see Configuring the
Microsoft Exchange Server SMTP Plug-in.
Configuring the Before you can add a Windows Event Log device, you must create a destination
Microsoft Exchange for the syslog events. For more information on creating a destination, see
Server SMTP Plug-in Configuring Destinations.
To configure your Microsoft Event Log device in the Adaptive Log Exporter:
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Devices tab.
Step 3 Right-click on Microsoft Exchange Server SMTP Logs and select Add Device.
The device properties for adding new a Microsoft Exchange Server with SMTP
Logs is displayed.
Step 4 Configure the following parameters:
Parameter Description
Name Type the name you want to assign this device.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Device Address Type the IP address or hostname for your Microsoft
Exchange Server.
Root Log Directory Click Browse or type the directory location for your Microsoft
Exchange log files.
The Microsoft Exchange Server SMTP Log plug-in monitors
recently created files in the root log directory that match the
following format:
• Files starting with (u_)ex, (u_)nc, or (u_)in
• Files ending with .log
The following directory location is the default directory for
storing Windows IIS audit log files:
<windir>\System32\Log Files\SMTPSVC1\
Where <windir> is the drive letter and directory path of
Windows, such as c:\Windows.
Note: Do not use the Microsoft Exchange Server SMTP Log
device plug-in to monitor files that can only be accessed over
the network, such as a file share.
Throttle timeout Type the delay between polling events, in milliseconds, for
the Windows Event Log device. The default throttle timeout is
500 milliseconds. The minimum value is 10 milliseconds.
The higher the value specified in the throttle timeout means
that the Adaptive Log Exporter checks for updated device
logs less often. The lower the value specified in the throttle
timeout means that the Adaptive Log Exporter checks for
updated device logs more often.
Creating a Device After you have configured your device, you must map your device to a destination.
Mapping
To map a device to a destination:
Step 1 Click the Destinations tab.
Step 2 Click + to expand the available destinations.
Microsoft SQL Server plug-in reads and forwards Microsoft SQL events from the
error log file. The error log is a standard text file that contains SQL Server
information and error messages. The error log can provide meaningful information
to assist you in troubleshooting issues or alerting you to potential or existing
problems. The error log output includes the time and date the message was
logged, the source of the message, and the description of the message. If an error
occurs, the log contains the error message number and description. This plug-in
supports Microsoft SQL Server 2000, 2005, and 2008.
Typically, SQL Server retains backups of the previous six logs and provides each
backup with an accrued number appended to the end of the name. For example,
ERRORLOG.1 being the most recent backup of the error log and ERRORLOG.2
being the second most recent.
Before you can configure any device plug-in for the Adaptive Log Exporter, you
must complete the following steps from previous chapters:
1 Configure the Adaptive Log Exporter update site. For more information, see
Configuring the Update Site.
2 Configure a destination for your Microsoft SQL Server events. For more
information, see Configuring Destinations.
If these steps are complete, you are ready to configure your Microsoft SQL Server
device plug-in and map your device to a destination.
Configuring a The Microsoft SQL Server device plug-in allows you to configure the root log
Microsoft SQL directory for your ERRORLOG files, configure polling options, and create a name
Server Device and IP address to identify your device. After you configure your device, you can
map your Microsoft SQL Server to a syslog destination.
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Devices tab.
Step 3 Right-click on Microsoft SQL and select Add Device.
The device properties for adding a new Microsoft SQL Server are displayed.
Step 4 Configure the following parameters:
Parameter Description
Name Type the name you want to assign this device.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Device Address Type the IP address or hostname for your DHCP Server.
Root Log Directory Click Browse or type the directory location for your Microsoft
SQL Server log files.
The following directory location is the default directory for
storing Microsoft SQL Server log files:
C:\Program Files\Microsoft SQL
Server\MSSQL\LOG\
Where <windir> is the drive letter and directory path of
Windows, such as c:\Windows.
Note: Do not use the Microsoft SQL Server device plug-in to
monitor files that can only be accessed over the network,
such as a file share.
Log Filename Type the name of the log file to be monitored by QRadar
SIEM.
By default, the log file name is ERRORLOG. If this field is left
blank, then the filename defaults to ERRORLOG.
Parameter Description
Throttle timeout Type the delay between polling events, in milliseconds, for
the Windows Event Log device. The default throttle timeout is
500 milliseconds. The minimum value is 10 milliseconds.
The higher the value specified in the throttle timeout means
that the Adaptive Log Exporter checks for updated device
logs less often. The lower the value specified in the throttle
timeout means that the Adaptive Log Exporter checks for
updated device logs more often.
Creating a Device After you have configured your device, you must map your device to a destination.
Mapping
To map a device to a destination:
Step 1 Click the Destinations tab.
Step 2 Click + to expand the available destinations.
If no + exists, you need to create a destination. For more information, see
Configuring Destinations.
Step 3 Right-click on a destination and select Add Device Mapping.
Step 4 A list of configured devices is displayed.
Step 5 Select your Microsoft SQL Server device.
A mapping is created for your Microsoft SQL Server device to the destination.
Step 6 Click Save.
Step 7 Click Deploy.
After the deploy process completes your events are forwarded from the Adaptive
Log Exporter to QRadar SIEM. These events are automatically discovered and
added as a log source using the name and IP address of your Microsoft SQL
Server device.
Step 8 Repeat this process to map additional Microsoft SQL Server devices.
The Microsoft SQL Server configuration is complete.
NOTE
You must enable UTF-8 logging in the Microsoft IIS service for this device to
function properly. For more information on enabling logging, see your Microsoft
IIS documentation.
CAUTION
The Adaptive Log Exporter can monitor up to 25 Microsoft IIS websites.
Before you can configure any device plug-in for the Adaptive Log Exporter, you
must complete the following steps from previous chapters:
1 Configure the Adaptive Log Exporter update site. For more information, see
Configuring the Update Site.
2 Configure a destination for your Microsoft IIS Server events. For more information,
see Configuring Destinations.
If these steps are complete, you are ready to configure your Microsoft IIS device
plug-in and map your device to a destination.
Configuring a The Microsoft IIS Server device plug-in allows you to configure the root log
Microsoft IIS Server directory for your log files to monitor up to 25 websites. The Microsoft IIS Server
Device device plug-in monitors the root log directory and any folders under the root log
directory that contain log files for IIS. After you configure your device, you can map
your Microsoft IIS Server device to a syslog destination.
NOTE
If you are using the Adaptive Log Exporter to monitor several individual websites
instead of the top-level website directory, we recommend you create several
Microsoft IIS device plug-ins to monitor these individual websites.
If you use customized directories for your log files, the sub-folders under your root
log directory must contain the name of the logs stored in the folder. Figure 12-1
displays a custom directory structure and the file names required for reading FTP
logs, Usenet logs (NNTP), e-mail logs (SMTP), and website logs (W3C).
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Devices tab.
Step 3 Right-click on Microsoft IIS and select Add Device.
The device properties for adding a new Microsoft IIS device are displayed.
Step 4 Configure the following parameters:
Parameter Description
Name Type the name you want to assign this device.
This name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Device Address Type the IP address or hostname for your Microsoft IIS
Server.
Note: If you configure the Adaptive Log Exporter to monitor
several individual websites, you must type the IP address or
hostname for the website.
Root Log Directory Click Browse or type the directory location for your Microsoft
IIS log files.
The Microsoft IIS plug-in monitors recently created files and
sub-folders under the root log directory that match the
following format:
• Files starting with (u_)ex, (u_)nc, or (u_)in
• Files ending with .log
Windows IIS log files are stored in the following default
directory:
<windir>\System32\LogFiles\
Where <windir> is the drive letter and directory path of
Windows, such as c:\Windows.
Note: Do not use the Microsoft IIS Server device plug-in to
monitor files that can only be accessed over the network,
such as a file share.
Web Logs Select this check box to monitor the event log files for IIS
website events.
By default, the Web Logs check box is selected.
FTP Logs Select this check box to monitor the event log files for IIS FTP
site events.
By default, the FTP Logs check box is selected.
IIS SMTP Logs Select this check box to monitor the event log files for Simple
Mail Transfer Protocol (SMTP) events.
NNTP Logs Select this check box to monitor the event log files for
Network News Transfer Protocol (NNTP) events.
Parameter Description
Throttle timeout Type the delay between polling events, in milliseconds, for
the Windows Event Log device. The default throttle timeout is
500 milliseconds. The minimum value is 10 milliseconds.
The larger the value specified in the throttle timeout means
that the Adaptive Log Exporter checks for updated device
logs less often. The smaller the value specified in the throttle
timeout means that the Adaptive Log Exporter checks for
updated device logs more often.
Creating a Device After you have configured your device, you must map your device to a destination.
Mapping
To map a device to a destination:
Step 1 Click the Destinations tab.
Step 2 Click + to expand the available destinations.
If no + exists, you need to create a destination. For more information, see
Configuring Destinations.
Step 3 Right-click on a destination and select Add Device Mapping.
Step 4 A list of configured devices is displayed.
Step 5 Select your Microsoft IIS device.
A mapping is created for your Microsoft IIS device to the destination.
Step 6 Click Save.
Step 7 Click Deploy.
After the deploy process completes your events are forwarded from the Adaptive
Log Exporter to QRadar SIEM. These events are automatically discovered and
added as a log source using the name and IP address of your Microsoft IIS device.
Step 8 Repeat this process to map additional Microsoft IIS devices.
The Microsoft IIS configuration is complete.
Before you can configure any device plug-in for the Adaptive Log Exporter, you
must complete the following steps from previous chapters:
1 Configure the Adaptive Log Exporter update site. For more information, see
Configuring the Update Site.
2 Configure a destination for your Microsoft IAS Server events. For more
information, see Configuring Destinations.
If these steps are complete, you are ready to configure your Microsoft IAS device
plug-in and map your device to a destination.
Configuring a The Windows IAS device plug-in allows you to configure the root log directory for
Microsoft IAS your .log or .isa log files, configure polling options, and create a name and IP
Device address to identify your device. After you configure your device, you can map your
Windows IAS device to a syslog destination.
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Devices tab.
Step 3 Right-click on Microsoft IAS and select Add Device.
The device properties for adding a new Microsoft IAS device are displayed.
Step 4 Configure the following parameters:
Parameter Description
Name Type the name you want to assign this device.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Device Address Type the IP address or hostname for your Microsoft IAS
Server.
Root Log Directory Click Browse or type the location of the server log files.
QRadar SIEM monitors recently created files in the Root Log
Directory that start with in or ias and end in .log.
By default, IAS and NPS log files are located in the following
directory:
<windir>\System32\LogFiles
Where <windir> is the drive letter and directory path of
Windows, such as c:\Windows.
Note: Do not use the Microsoft IAS device plug-in to monitor
files that can only be accessed over the network, such as a
file share.
Throttle timeout Type the delay between polling events, in milliseconds, for
the Microsoft IAS Server logs. The default throttle timeout is
500 milliseconds. The minimum value is 10 milliseconds.
The larger the value specified in the throttle timeout means
that the Adaptive Log Exporter checks for updated device
logs less often. The lower the value specified in the throttle
timeout means that the Adaptive Log Exporter checks for
updated device logs more often.
You are now ready to map your Microsoft IAS Server device to a syslog
destination.
Creating a Device After you have configured your device, you must map your device to a destination.
Mapping
To map a device to a destination:
Step 1 Click the Destinations tab.
Step 2 Click + to expand the available destinations.
If no + exists, you need to create a destination. For more information, see
Configuring Destinations.
Step 3 Right-click on a destination and select Add Device Mapping.
Step 4 A list of configured devices is displayed.
Step 5 Select your Windows IAS device.
A mapping is created for your Windows IAS device to the destination.
Step 6 Click Save.
Step 7 Click Deploy.
After the deploy process completes your events are forwarded from the Adaptive
Log Exporter to QRadar SIEM. These events are automatically discovered and
added as a log source using the name and IP address of your Windows IAS
device.
Step 8 Repeat this process to map additional Windows IAS devices.
The Windows IAS configuration is complete.
The Microsoft Internet Security and Acceleration (ISA) Server provides you with
network proxy and firewall service logs for Microsoft ISA and Microsoft Forefront
Threat Management Gateway (TMG) 2010. The Windows ISA device plug-in for
the Adaptive Log Exporters allows you to forward .w3c or .isa formatted log files.
CAUTION
Windows ISA Server files can contain payloads larger than 1024 bytes, which is
the maximum payload size for the UDP protocol. We recommend that you
configure a TCP syslog destination for Windows ISA device plug-ins reporting
events for Windows ISA Servers.
Before you can configure any device plug-in for the Adaptive Log Exporter, you
must complete the following steps from previous chapters:
1 Configure the Adaptive Log Exporter update site. For more information, see
Configuring the Update Site.
2 Configure a destination for your Windows ISA events. For more information, see
Configuring Destinations.
If these steps are complete, you are ready to configure your Windows ISA device
plug-in and map your device to a destination.
Configuring The Windows ISA device plug-in allows you to configure the root log directory for
Windows ISA your .w3c or .isa log files, configure polling options, and create a name and IP
address to identify your device. After you configure your device, you can map your
Windows ISA device to a syslog destination.
Step 1 From the Start menu, select Programs > Adaptive Log Exporter > Configure
Adapter Log Exporter.
Step 2 Click the Devices tab.
Step 3 Right-click on Microsoft ISA and select Add Device.
The device properties for adding new a Microsoft ISA device are displayed.
Step 4 Configure the following parameters:
Parameter Description
Name Type the name you want to assign this device.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Device Address Type the IP address or hostname for your local or remote
Windows host.
Parameter Description
Root Log Directory Click Browse or type the location of the Microsoft ISA Server
log files. QRadar SIEM monitors recently created files in the
Root Log Directory ending with .w3c or .iis.
By default, the ISA log files are located in the following
directories:
• For Microsoft ISA 2004:
<Program Files>\MicrosoftISAServer\ISALogs\
Where <Program Files> is the drive letter and directory
path of your Program Files directory, such as c:\Program
Files.
• For Microsoft ISA 2006:
<windir>\System32\LogFiles\
Where <windir> is the drive letter and directory path of
Windows, such as c:\Windows or d:\Windows.
• For Microsoft Forefront Threat Management Gateway:
<Program Files>\<Forefront Directory>\Logs\
Where:
<Program Files> is the drive letter and directory path of
your Program Files directory, such as c:\Program Files.
<Forefront Directory> is the installation directory for
your Microsoft Forefront Threat Management Gateway.
Note: Do not use the Windows ISA device plug-in to monitor
files that can only be accessed over the network, such as a
file share.
Throttle timeout Type the delay between polling events, in milliseconds, for
the Microsoft ISA logs. The default throttle timeout is 500
milliseconds. The minimum value is 10 milliseconds.
The larger the value specified in the throttle timeout means
that the Adaptive Log Exporter checks for updated device
logs less often. The lower the value specified in the throttle
timeout means that the Adaptive Log Exporter checks for
updated device logs more often.
Creating a Device After you have configured your device, you must map your device to a destination.
Mapping
Troubleshooting When you contact Customer Support for assistance, you may be requested to
Files copy, compress, and send the following dirctories:
• C:\Program Files\Adaptive Log Exporter\config\*.*
• C:\Program Files\Adaptive Log Exporter\logs\*.*
On 64-bit operating systems, the folders are located at the following paths:
• C:\Program Files(x86)\Adaptive Log Exporter\config\*.*
• C:\Program Files(x86)\Adaptive Log Exporter\logs\*.*
The following table describes the log files you can use to troubleshoot your
Adaptive Log Exporter issues:
Table A-1 Useful Log Files
Enabling Debug The Adaptive Log Exporter can be configured in debug mode for logging additional
Mode troubleshooting messages. Debug mode for the Adaptive Log Exporter is a feature
specifically defined for advanced troubleshooting for customer support.
CAUTION
Debug mode should only be enabled for troubleshooting when requested by
customer support. Enabling debug mode on the Adaptive Log exporter consumes
additional resources, such as increased CPU usage and increased disk storage
due to the number of logs and events being processed. Enabling debug mode can
lead to significant performance issues on the host system. For more information,
see Contacting Customer Support.
Step 1 Navigate to the following directory on the Adaptive Log Exporter host:
C:\Program Files\Adaptive Log Exporter\Config\
On 64-bit operating systems, this file location can be the following:
C:\Program Files (x86)\Adaptive Log Exporter\Config\
Step 2 Open the following file:
logconfig.txt
Step 3 Edit the root category priority from info to debug:
log4j.rootCategory=DEBUG, ApndrConsole
Step 4 Edit the code logs priority from info to debug:
Restarting the To enable any changes made to the log configuration, you must restart the
Adaptive Log Adaptive Log Exporter Service.
Exporter Service
Step 1 On your desktop, select Start > Run.
The Run window is displayed.
Step 2 Type the following:
services.msc
Step 3 Click OK.
The Services window is displayed.
Step 4 Right-click on the AdaptiveLogExporterService and select Restart.
After the service restarts, the Adaptive Log Exporter is configured for debug mode.
When you are done debugging your Adaptive Log Exporter installation, we
recommend you disable debug mode by changing the log values back to debug.
Update Site If you click Add Plugins on the toolbar and receive an error indicating that the
Unreachable Adaptive Log Exporter site is unavailable or unreachable, you must correct the
location of the update site in the Adaptive Log Exporter preferences. This issue
often occurs when the default site has not been updated after the initial installation.
Step 5 In the Update Site URL field, type the location of your update site file.
For example,
• To update from the Internet, type a URL:
http://downloads.q1labs.com/windowsagent
• To update from a Windows share, type the path to your server:
file://<SOMEWINDOWSSERVER>/ALE/UpdateSite
• To update from a local file, type the path to the file:
file:///e:/UpdateSite
NOTE
If you choose a Windows server or local file, you must download the
ALEUpdateSite.zip file from the support website and extract the file to a Windows
share or file repository. The update site file is located at the following address:
http://www.ibm.com/support/fixcentral/. For more information, see Configuring
Updates for Off-line Sites.
Verifying Devices If you have completed your device plug-in configuration and QRadar SIEM is not
are Creating Events receiving the expected events, you can confirm that events are being created at
the event source. We recommend you log the events to a file on the local disk by
creating a logger destination for the Adaptive Log Exporter. A logger destination
allows you to write a log file for your device to the logs folder in your Adaptive Log
Exporter directory, allowing you to verify that events are created.
CAUTION
Logging events to a file on the local disk consume large amounts of disk space
very quickly. On high event per second hosts, we highly recommend that you
disable your logger destination after verifying that events are created. No method
exists for cleaning up a log file after enabling an event logger for a device.
Parameter Description
Name Type the name you want to assign this destination.
The name can include up to 50 alphanumeric characters,
underscores (_), hyphens (-), and periods (.).
Description Type a description for this device.
The description can include up to 100 characters.
Logger Prefix Type the heading you want to assign to the logs.
The Logger Prefix must start with Device.Events and may
contain letters, numbers and periods.
For example, Device.Events.troubleshooting.
Prepend syslog Select this check box if you want the syslog header to be
header attached to the message in the logs.
Number of Type the number of concurrent processing threads you want
Threads run in this destination. The default is 1.
Step 11 If events are created, we recommend that you delete the logger you created for
troubleshooting.
Deleting a Logger After you have verified the Adaptive Log Exporter is writing events to a log file, we
Destination recommend you delete the logger destination.
Verifying QRadar After you have verified that the Adaptive Log Exporter is logging events for your
SIEM is Receiving device to a log file, you can then verify that your QRadar SIEM Console or Event
Events Collector is receiving the syslog events. You can use the tcpdump packet analyzer
through the Command Line Interface (CLI) to look for the IP address of your
Adaptive Log Exporter device. This process determines if there is a network issue
between the Adaptive Log Exporter and QRadar SIEM.
NOTE
If the QRadar SIEM Console or Event Collector uses a different network interface,
you must adjust the -i interface command.
Configuring When using the Windows Event Log plug-in or NetApp Data ONTAP to retrieve
Adaptive Log events from remote machines, issues can occur with user credentials. The
Exporter Service Adaptive Log Exporter polls for new events using a registry call to the remote
Credentials Windows operating system. The registry for new events is read from the remote
Windows host. The Adaptive Log Exporter uses NetBIOS to call dynamic-link
library (DLL) files, which process the remote event logs. The Adaptive Log
Exporter must be able to remotely access the C$ share, also known as the
Administrative share on the remote machine.
If the Adaptive Log Exporter service does not have the proper permission level, the
ALE_Device.log file can display the following error:
C:\Program Files\Adaptive Log Exporter\logs\ALE_Device.log:
2010-12-02 11:18:15,000 WARN
Device.WindowsLog.MessageFormatterBase.GetRawMessageFromFiles:
Could not load requested file
'\\Test\C$\WINDOWS\System32\MsAuditE.dll', Reason = 5
The error indicates that the Adaptive Log Exporter could not read a remote DLL file
named MsAuditE.dll. You must configure the Adaptive Log Exporter service with
the correct credentials to access the Windows host remotely. The permission level
typically required is Domain Administrator.
Parameter Description
This Account Select this option, and then type or click Browse to assign a
user account with Domain Administration credentials to the
Adaptive Log Exporter service.
Password Type the password for the user account.
Confirm password Type the password again to confirm the password for the user
account.
Troubleshooting This section provides information on warning and error messages to assist you
Common Error and with finding resolving for common Adaptive Log Exporter issues.
Warning Messages
Example: Remote The following error message can indicate an additional error message when the
Permissions Adaptive Log Exporter service does not have sufficient administrative privileges or
when a DLL file is missing that is required to decode a specific portion of an event
payload:
NOTE
This error message only applies to the Windows Event Log plug-in when
collecting events from remote hosts using the Remote Machine check box.
Warning messages for the following DLL files can indicate a credentials issue with
the Adaptive Log Exporter service when attempting to read events from a Windows
host remotely:
• adtschema.dll
• ws03res.dll
• xpsp2res.dll
• MsAuditE.dll
You can verify that the credentials for the Adaptive Log Exporter service are
correct by opening a Remote Desktop session with the problematic Windows host.
Attempting to log in remotely with the username and password for the Adaptive
Log Exporter service can identify if the error is credential related. If the connection
fails, the remote host you are attempting to connect to might not allow remote login
attempts. Contact your network administrator to verify the configuration of the
remote Windows host.
Example: Event Per When the event per second (EPS) rate of the host is greater than the Adaptive Log
Second Overload Exporter can process, events can be dropped. The following error message
indicates that the Adaptive Log Exporter is unable to process events at the same
rate that events are generated.
NOTE
If your Adaptive Log Exporter is dropping events, we recommend you contact
Customer Support to determine if your configuration can be optimized.
Example: The Adaptive Log Exporter reads Windows-based event data using the Windows
Unexpected Value in Event Log device plug-in and assembles event messages as name value pairs. If
Payload an unexpected value is included in the Windows Event Log payload that the
Adaptive Log Exporter cannot process, the following error message is generated:
The Adaptive Log Exporter does not discard events with unexpected name value
pairs. The events messages are forwarded to QRadar SIEM and parsed as an
unknown or generic Windows event.
Enabling the Print The print spooler service is required on each system hosting the Adaptive Log
Spooler Exporter.
To enable the print spooler for the Adaptive Log Exporter service:
Step 1 On the desktop of the Windows host, select Start > Run.
The Run window is displayed.
Launching the After installing the Adaptive Log Exporter on Windows 2008R2 operating systems,
Adaptive Log the following message can be displayed when attempting to launch the Adaptive
Exported in Log Exporter interface:
Windows 2008R2
/org/eclipse/update/search/IUpdateSearchFilter
The error above indicates there is a compatibility issue occurring with the Adaptive
Log Exporter and your installation of Windows 2008R2. We recommend you run
the Adaptive Log Exporter in compatibility mode for Windows XP.
NOTE
For examples of updating your Windows Event Log device configuration, see
Updating Examples.
Patching the To patch the Windows Event Log device plug-in on the Adaptive Log Exporter:
Windows Event Log
Device
Parameter Description
/SP- Allows the initial installation setup message to be
suppressed.
/VERYSILENT Allows the installation to run in the background.
/SUPPRESSMSGBOXES Allows setup message to be suppressed during the
installation.
/PATCHONLY Allows you to update your Windows Event Log and apply the
latest fixes without modifying any existing device plug-in
configurations. This command should only be used with the
/SP-, /VERYSILENT, and /SUPPRESSMSGBOXES options.
NOTE
The Adaptive Log Exporter CLI installation instructions include an example of
using a batch script to install the Adaptive Log Exporter. The batch script example
includes the /PATCHONLY command, which installs the Adaptive Log Exporter.
and patches the Windows Event Log device plug-in simultaneously. For more
information, see Batch File Command Line Install Script.
Updating a Windows You can use the ALE_WindowsEventLogPlugin_setup to update the configuration
Event Log parameters of a Windows Event Log device plug-in.
Configuration
To update a Windows Event Log configuration using the CLI:
Step 1 Download the ALE_WindowsEventLogPlugin_setup file from the Qmmunity
website.
https://qmmunity.q1labs.com/node/546
Step 2 Copy the ALE_WindowsEventLogPlugin_setup.exe file to the system hosting the
Adaptive Log Exporter.
Step 3 From the desktop of the Windows host, select Start > Run.
The Run window is displayed.
Step 4 Type the following command:
cmd
Parameter Description
/SP- Allows the initial installation setup message to be
suppressed.
/VERYSILENT Allows the installation to run in the background.
/SUPPRESSMSGBOXES Allows setup message to be suppressed during the
installation.
/MONITOR Allows you to specify the list of event logs you want to
monitor on the Windows operating system. The following
Windows event logs can be monitored:
• Application
• Security
• System
• **Directory Service
• **DNS Server
• **File Replication
The event log types must be separated using a
comma-separated list.
For example,
/MONITOR=”Application”,”Security”,”System”,”
Directory Service”,”DNS Server”
Note: The ** indicates that these Windows Event Logs can
be configured using the CLI to collected events, but the
check boxes for these event types are not displayed in the
configuration until you update your Windows Event Log
device plug-in.
/MONITORDEST Allows you to specify the syslog destination that you want to
receive the events. The IP address you type must be the
address of your QRadar SIEM Console or Event Collector.
For example,
/MONITORDEST=10.100.100.100:514
If you do not specify a port number, the default of port 514 is
used for forwarding syslog events.
Parameter Description
/MONITORPROTO Allows you to select the protocol to use when sending syslog
events to QRadar SIEM. The protocol can be specified as
TCP or UDP.
For example,
/MONITORPROTO=TCP
or
/MONITORPROTO=UDP
If this parameter is not defined, the Adaptive Log Exporter
service defaults to sending events using the UDP protocol.
/DEVICEADDRESS Type the hostname or IP address for the device that sends
the Windows events to QRadar SIEM.
For example,
/DEVICEADDRESS=10.100.100.100
or
/DEVICEADDRESS=workstation102
or
/DEVICEADDRESS=%computername%
Note: The device address field allows you to include system
variables for bulk installations of the Adaptive Log Exporter.
For example, %computername%.
For example, to changed the destination IP address for QRadar SIEM from
10.100.100.100 to 10.100.1.1, type the following:
ALE_WindowsEventLogPlugin_setup.exe /SP- /VERYSILENT
/SUPPRESSMSGBOXES /MONITORDEST=10.100.1.1:514
/DEVICEADDRESS=%COMPUTERNAME%
The /MONITORDEST parameter is updated for the Windows Event Log device
plug-in.
The Windows Event Log device plug-in parameters are updated.
Updating Examples This section provides several examples of using the Command Line Interface (CLI)
to update your Windows Event Log device plug-in:
• Updating the Device Address for the Windows Host
• Update Logs Monitored for Windows Event Log Device
• Updating the Windows Event Log Protocol
Table C-1 provides information on the device plug-ins supported by the Adaptive Log Exporter.
IBM Security QRadar SIEM integrates with many manufacturers and vendors of security products. Our list of supported
plug-ins and documentation is updated regularly. If your device is not listed in this document, contact your sales
representative.
Manufact Device
urer Product Log Files Collected Plug-in Default Log File Directory
Cisco ACS Comma-separated event logs Cisco ACS Cisco ACS log files are stored in a log directory by the service
name:
<ACS Directory>\<Service Name>\Logs\
Cisco CSA logfile.txt Cisco CSA Cisco CSA log files are stored in the following directory:
C:\alerts\
Juniper Steel-Belted Radius Comma-separated event logs, for Juniper SBR Juniper Networks Steel-Belted Radius log files are stored in the
Networks example: following folder of the installation directory:
• accepts_yyyymmdd.csv <SBR directory>\authReports\
• rejects_yyyymmdd.csv
• unknownClient_yyyymmdd.csv
• badSharedSecret_yyyymmdd.csv
Microsoft Windows 2000, • Application Windows None required. Selecting an event type check box allows the
Windows 2003 Server, Event Log Adaptive Log Exporter to retrieve events using an API call for the
• Security
Windows 2008 Server, required data.
Windows XP, • System
and Windows 7 • Directory Service
• DNS
• File Replication
Manufact Device
urer Product Log Files Collected Plug-in Default Log File Directory
Microsoft DHCP Server DhcpSrvLog, or Windows Microsoft DHCP log files are stored in the following directory:
DhcpV6SrvLog DHCP <windir>\system32\dhcp\
Microsoft Exchange 2003 SMTP files that end in .log and Microsoft Microsoft Exchange SMTP log files are stored in the following
begin with one of the following: Exchange directory:
Server
• (u_)ex - For W3C formatted log <windir>\System32\LogFiles\SMTPSVC1\
SMTP Logs
files.
• (u_)nc - For NCSA formatted log
files.
• (u_)in - For IIS formatted log
files.
Microsoft Exchange 2003 or OWA files that end in .log and Microsoft Microsoft Exchange OWA log files are stored in the following
Exchange 2007 begin with one of the following: Exchange directory:
Server OWA <windir>\System32\LogFiles\W3SVC1\
• (u_)ex - For W3C formatted log
Logs
files.
• (u_)nc - For NCSA formatted log
files.
• (u_)in - For IIS formatted log
files.
Microsoft IAS Server IAS log files ending in one of the Windows Microsoft IAS log files are stored in the following directory:
following formats: IAS C:\windows\system32\LogFiles\
• .ias
• .log
Microsoft IIS • Web logs Microsoft IIS Microsoft IIS log files are stored in the following directory:
• FTP logs C:\windows\system32\LogFiles\
• IIS SMTP Logs
• NNTP logs
Manufact Device
urer Product Log Files Collected Plug-in Default Log File Directory
Microsoft ISA and Forefront ISA log files that end in one of the Windows Log directory for Microsoft ISA 2004:
Threat Management following formats: ISA <Program Files>\MicrosoftISAServer\ISALogs\
Gateway • .w3c Log directory for Microsoft ISA 2006:
• .isa <windir>\System32\LogFiles\
Log directory for Microsoft Forefront Threat Management
Gateway:
<Program Files>\<Forefront Directory>\ISALogs\
Microsoft SQL Server 2000, ERRORLOG Microsoft Microsoft SQL Server logs are stored in the following directory:
2005, and 2008 SQL Server C:\Program Files\Microsoft SQL Server\MSSQL\LOG\
NetApp Data ONTAP Event log files that end in .evt. NetApp NetApp Data ONTAP logs are stored in the following directory:
/etc/log
Trend InterScan VirusWall System and virus log files. Trend Micro The InterScan VirusWall event logs can be found in one of the
Micro InterScan following directory locations:
VirusWall • <installation folder>\Log directory
• Program Files\InterScan\logs
• Notices
• Trademarks
Notices This information was developed for products and services offered in the U.S.A.
IBM may not offer the products, services, or features discussed in this document in
other countries. Consult your local IBM representative for information on the
products and services currently available in your area. Any reference to an IBM
product, program, or service is not intended to state or imply that only that IBM
product, program, or service may be used. Any functionally equivalent product,
program, or service that does not infringe any IBM intellectual property right may
be used instead. However, it is the user's responsibility to evaluate and verify the
operation of any non-IBM product, program, or service.
IBM may have patents or pending patent applications covering subject matter
described in this document. The furnishing of this document does not grant you
any license to these patents. You can send license inquiries, in writing, to:
IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785 U.S.A.
For license inquiries regarding double-byte character set (DBCS) information,
contact the IBM Intellectual Property Department in your country or send inquiries,
in writing, to:
Intellectual Property Licensing
Legal and Intellectual Property Law
IBM Japan Ltd.
19-21, Nihonbashi-Hakozakicho, Chuo-ku
Tokyo 103-8510, Japan
The following paragraph does not apply to the United Kingdom or any other
country where such provisions are inconsistent with local law:
The licensed program described in this document and all licensed material
available for it are provided by IBM under terms of the IBM Customer Agreement,
IBM International Program License Agreement or any equivalent agreement
between us.
Information concerning non-IBM products was obtained from the suppliers of those
products, their published announcements or other publicly available sources. IBM
has not tested those products and cannot confirm the accuracy of performance,
compatibility or any other claims related to non-IBM products. Questions on the
All statements regarding IBM's future direction or intent are subject to change or
withdrawal without notice, and represent goals and objectives only.
All IBM prices shown are IBM's suggested retail prices, are current and are subject
to change without notice. Dealer prices may vary.
This information contains examples of data and reports used in daily business
operations. To illustrate them as completely as possible, the examples include the
names of individuals, companies, brands, and products. All of these names are
fictitious and any similarity to the names and addresses used by an actual
business enterprise is entirely coincidental.
If you are viewing this information softcopy, the photographs and color illustrations
may not appear.
Trademarks IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of
International Business Machines Corp., registered in many jurisdictions worldwide.
Other product and service names might be trademarks of IBM or other companies.
A current list of IBM trademarks is available on the Web at “Copyright and
trademark information” at www.ibm.com/legal/copytrade.shtml.
Java and all Java-based trademarks and logos are trademarks or registered
trademarks of Oracle and/or its affiliates.
Microsoft, Windows, Windows NT, and the Windows logo are trademarks of
Microsoft Corporation in the United States, other countries, or both.
UNIX is a registered trademark of The Open Group in the United States and other
countries.