topic Re: XIQ-SE Syslog configuration in ExtremeCloud IQ- Site Engine Management Center

XIQ-SE Syslog configuration

ChristianK — Mon, 23 Dec 2024 09:42:36 GMT

We have an active Syslog configuration.

Now the IP of the Syslog receiver will be changed.

At which point is the IP configuration of the Syslog done?

Re: XIQ-SE Syslog configuration

Robert_Haynes — Mon, 23 Dec 2024 13:34:38 GMT

Hello. I do not quite exactly understand your question as worded.

XIQ-SE is a syslog receiver. Devices would point to the IP address of XIQ-SE to send XIQ-SE syslog related messages.

XIQ-SE has a feature/function to attempt to register itself as this syslog receiver / endpoint. Administration -> Options -> Syslog. For supported devices XIQ-SE will try to configure itself as a syslog receiver. It can also be configured to periodically check the syslog receiver configuration every 12 hours (by default) if enabled.

Re: XIQ-SE Syslog configuration

ChristianK — Mon, 23 Dec 2024 16:10:26 GMT

We forward the logs from XIQ-SE to our SIEM solutions.

The SIEM Solutions will be changed. So I have to change the IP in the Syslog forwarding configuration.

Does this make my request more clear?

Re: XIQ-SE Syslog configuration

Zdeněk_Pala — Tue, 24 Dec 2024 10:30:43 GMT

check your alarm configuration = probably you are senting events to external syslog server through alarm rule.

Check NAC notifications = it is a common approach to send NAC related events to external syslog server.

Check the security best practices document (documentation) there are additional options how to configure syslog export.

Re: XIQ-SE Syslog configuration

Robert_Haynes — Tue, 24 Dec 2024 13:22:08 GMT

Mr. Pala is correct. You can forward syslog from SE to a third-party via Alarm actions, Control Notification rules and by making custom changes to the rsyslog configuration under-the-hood on SE itself. Those would be the three places you would have to look at.

Alarms & Events -> Alarm Configuration -> sort by Action -> look for any that are tied to syslog actions

Control -> Access Control -> Configuration -> Notifications -> look for any that are tied to syslog actions

/etc/rsyslog.conf under-the-hood via SSH

Re: XIQ-SE Syslog configuration

ChristianK — Fri, 27 Dec 2024 07:19:45 GMT

My configuration was under
Control -> Access Control -> Configuration -> Notifications

Many thanks for the hint.