Syslog - Cisco ACS

Configure the Remote Log Target

To configure Cisco ACS Log Collection, a Remote Log Target must be created. Before starting these instructions, acquire the IP address of the System Monitor that will be collecting Cisco ACS logs.

1. From the Cisco ACS user interface, click System Administrator, click Configuration, and then click Remote Log Targets.
2. Click Create.
3. Click Remote Log Targets, and then click Create.
4. Complete the following required fields:
   • Name. LogRhythm
   • Description. LogRhythm Logging
   • Type. Syslog

   • IP Address. Enter the IP of the LogRhythm System Monitor.

     

     Do not change any Advanced settings. Changing these settings will cause unpredictable behavior in the log collecting process.

5. Click Submit to save the configuration.
6. Note the name of the log target just created because it is needed later in these instructions.

Configure Global Logging Severity

The severity level at which logs are collected must be configured. Follow these instructions to configure the severity level of the logs being collected.

1. From the Cisco ACS user interface, click System Administrator, click Configuration, click Log Configuration, click Logging Categories, and then click Global.
2. Select the radio button of the logging category to be configured, and then click Edit.
3. Click Log Severity, and then choose from the following:
   For diagnostic logging categories, use the list to select the severity level. (For audit and accounting categories, there is only one severity, NOTICE, which cannot be modified.) Valid options are:
   • FATAL. Emergency. ACS is not usable and you must take action immediately.
   • ERROR. Critical or error condition.
   • WARN. Normal, but significant condition. (Default)
   • INFO. Informational message.
   • DEBUG. Diagnostic bug message.
4. Click Submit to save the changes.

Configure Global Logging Categories

Logging categories determine the kind of logs to be collected. These categories must be assigned to the Remote Target previously created in the Configure the Remote Log Target instructions.

1. From the Cisco ACS user interface, click System Administration, click Log Configuration, click Logging Categories, and then click Global.
2. Select a logging category for which you want to receive logs.
3. Click the Remote Syslog Target tab.
4. In the Available Targets field, click the target created in the Create Remote Log Target instructions.
5. Click the greater than (>) button.
6. Click Submit.
7. Repeat for each logging category for which you want to receive logs.

After you configure the device, you must also configure LogRhythm according to the instructions provided on the overview page of this guide. Only Global Admins or Restricted Admins with elevated View and Manage privileges can take this action.

The name of the log message source is Syslog - Cisco ACS. In addition, when configuring this log source:

• For Log Message Processing Mode, select MPE Processing Enabled, Event Forwarding Enabled.
• For Log Message Processing Engine (MPE) Policy, select LogRhythm Default.