One Identity Safeguard for Privileged Sessions (SPS) can send its system log messages to remote syslog servers (for example, syslog-ng Premium Edition, syslog-ng Store Box, Splunk, or HPE ArcSight Data Platform).

NOTE: To send log messages in any custom format, contact our Support Team.

 Caution:

The retention time for local logs of SPS is seven days. To retain them longer, forward them to a remote logserver.

Figure 158: Basic Settings > Management > Syslog — Configuring system logging

To configure logging to a remote server

  1. Navigate to Basic Settings > Management.

  2. Click in the Syslog > Syslog receivers field to add a new syslog server.

  3. Enter the IP address and port of the syslog server into the respective fields.

    Use an IPv4 address.

  4. Select the network protocol used to transfer the messages in the Protocol field. The legacy- prefix corresponds to the legacy BSD-syslog protocol described in RFC3164, while the syslog- prefix corresponds to the new IETF-syslog protocol described in RFC5424. Note that not every syslog server supports the IETF protocol yet.

    Select TCP+TLS to send the log messages using a TLS-encrypted connection.

    TIP: Transferring the syslog messages using TCP ensures that the server receives them.

    Transferring the syslog messages using TLS encryption ensures that third parties cannot read the messages. However, not every syslog server accepts encrypted connections. The syslog-ng Premium Edition and Open Source Edition applications, and the syslog-ng Store Box (which is a log-collector appliance similar to SPS) support both encrypted connections and the new IETF-syslog protocol as well. For details on these products, see syslog-ng Premium Edition and syslog-ng Store Box.

  5. If the syslog server requires mutual authentication, that is, a certificate from SPS, check Authenticate as client.

    1. Generate and sign a certificate for SPS, then click the icon in the Client X.509 certificate field to upload the certificate. After that, click the icon in the Client key field and upload the private key corresponding to the certificate.

  6. If you have selected the TCP+TLS protocol and you want SPS to verify the certificate of the syslog server, complete the following steps. Otherwise, click .

    1. Select Check server certificate.

    2. Select a Trust Store.

      NOTE: You can only select a trust store with None or Full revocation check type.

      SPS will use this trust store to verify the certificate of the server, and reject the connections if the verification fails. For more information on creating trust stores, see Verifying certificates with Certificate Authorities using trust stores.

    3. Click .

  7. To display separate hostnames for syslog messages sent by the nodes of a SPS HA cluster, select the Include node ID in hostname in boot firmware messages option. The node ID included in the hostname file of the syslog message is the MAC address of the node's HA interface. (Messages of the core firmware are always sent by the primary node.)

    The boot firmware boots up SPS, provides High Availability support, and starts the core firmware. The core firmware, in turn, handles everything else: provides the web interface, manages the connections, and so on.

  8. Click the and icons to add new servers or delete existing ones.

    NOTE: To reduce the risk of the syslog server not receiving log messages from SPS because of a network outage or other problem with the syslog server, SPS buffers up to 10 Megabytes of log messages to its hard disk in case the syslog server becomes unaccessible.