XYGATE Merged Audit Reference Manual

XYGATE Merged Audit
®
Reference Manual
Chapter 2. Sending Data to Your ArcSight SIEM
XYPRO Technology Corporation 36 Proprietary and Confidential
Checking EMS
If the SLSENDER is unable to send data to the SIEM, a message will be sent to EMS
as shown below.
Sample EMS message
09:16 23OCT13 047,01,1177 XYPRO Product:XYGATEMA Msg#:223 Level:Critical
Msg:Syslog Sender SLSENDER (\PROD.$X220) unable to send messages to host
127.1.1.0, port 514
Sample Query to Determine Backlog in the SYSLOGQ Files
You can run the query below to determine if there is a backlog of records in the
SYSLOGQ table.
1. Copy the lines below into an edit file.
2. Run the query by using the following command:
>SQLCI/in <filename>/
-- Update the line below to point to your XMA
-- data subvolume
volume $<vol>.XMADAT;
set list_count 0;
set headings off;
select alertedgmt, count (*),min(entrygmt),max (entrygmt) from syslogq
where
ALERTEDGMT = datetime "1970-01-01:00:00:00.000000" year to
fraction(6)
group by ALERTEDGMT
order by ALERTEDGMT
browse access;
name col 1 agdt;
name col 2 thecount;
name col 3 oldest;
name col 4 newest;
TITLE
"SYSLOGQ File",
skip 1,
"Count and Oldest and Newest Unsent Records",
skip 1,
"Date: ", CURRENT_timestamp AS DATE "m2/d2/Y4", SPACE 5,
"Time: ", CURRENT_timestamp AS TIME "HP2:M2";
Detail
"Number of Unsent Records",
skip 1,
"------------------------",
skip 1,
thecount,
skip 2,
"Unsent Record Date Range",
skip 1,
"------------------------",
skip 1,
"Oldest Unsent Record: ", oldest,