Customizing the syslog server address

Specify the following values in the SERVER statement in the $$$SERVR member of the amihlq.CZAGENT.PARM data set:

  • IP address of the BMC Defender Server or syslog console
  • IP port number (if it is not the standard syslog default, port 514)

The IP address and optional port are specified on the SERVER statement in the parameter file as a host name or in IPv4 dotted format.

Note

If you want to connect to the BMC Defender Server through TCP, you must use the RFC3164 protocol and uncomment (remove the leading semicolon) the FRAMING(OCTET) parameter in $$$SERVR:

; ---------------------------------------------------------------------
; Uncomment the following OPTIONS if you are connecting
; to the BMC AMI Command Center or BMC AMI SyslogDefender
; with SERVER TRANS(TCP)
; ---------------------------------------------------------------------
;OPTIONS FRAMING(OCTETCOUNT) ; Framing (LF,CR,CRLF,NULL,OCTETCOUNT)


The following code shows the entire SERVER statement in the $$$SERVR member:

;**********************************************************************;
;**********************************************************************;
; CZASERVR: User-supplied server definitions ;
;**********************************************************************;
;**********************************************************************;

SAY "v6.0.02 Updated 20 March 2020"

; Options dependent on SIEM type
OPTIONS IF(CEF) SIEM(CEF) TIMESTAMP +
 INSTNAME(CEF.Agent)
OPTIONS IF(JSON) SIEM(JSON) +
 INSTNAME(Agent.JSON)
OPTIONS IF(LEEF) SIEM(LEEF) TIMESTAMP +
 INSTNAME(LEEF.Agent)
OPTIONS IF(RFC3164) SIEM(RFC3164) TIMESTAMP +
 INSTNAME(SIEM.Agent)
OPTIONS IF(Splunk) SIEM(Splunk) TIMESTAMP +
 INSTNAME(Agent.for.Splunk)

OPTIONS SWAP(NO) ; Recommended default is NO
OPTIONS QUEUE64(1024) ; 1GB default

; ---------------------------------------------------------------------
; Uncomment the following OPTIONS if you are connecting
; to the BMC AMI Command Center or BMC AMI SyslogDefender
; with SERVER TRANS(TCP)
; ---------------------------------------------------------------------
;OPTIONS FRAMING(OCTETCOUNT) ; Framing (LF,CR,CRLF,NULL,OCTETCOUNT)
; ---------------------------------------------------------------------
; You must uncomment (remove the semi-colon(;)) from one of the SERVER
; statements below
; ---------------------------------------------------------------------
; ---------------------------------------------------------------------
; RFC3164
; ---------------------------------------------------------------------
;SERVER ip.addr.example TRANS(UDP) MAXMSG(2000) ; You MUST edit per doc

; ---------------------------------------------------------------------
; CEF - TRANS(TCP) Recommended
; ---------------------------------------------------------------------
;SERVER ip.addr.example TRANS(TCP) MAXMSG(2000) ; You MUST edit per doc

; ---------------------------------------------------------------------
; JSON - TRANS(TCP) Recommended
; ---------------------------------------------------------------------
;SERVER ip.addr.example TRANS(TCP) MAXMSG(3000) ; You MUST edit per doc

; ---------------------------------------------------------------------
; LEEF - TRANS(TCP) Required by QRadar
; ---------------------------------------------------------------------
;SERVER ip.addr.example TRANS(TCP) MAXMSG(2000) ; You MUST edit per doc

; ---------------------------------------------------------------------
; SPLUNK - TRANS(TCP) Recommended
; ---------------------------------------------------------------------
;SERVER ip.addr.example TRANS(TCP) MAXMSG(3000) ; You MUST edit per doc

; ---------------------------------------------------------------------
; Uncomment and edit the following TIME statement if desired
; ---------------------------------------------------------------------
; TIME UTC DUR(ISO8601_T) TIMEOFDAY(ISO8601_T) ZONE(TZ)

Related topic

SERVER-statement

Customizing-for-a-proprietary-syslog-extension

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*