Follow these steps to add an Rsyslog receiver for metadata streaming of Email Security - Server appliance email events:
To add an Rsyslog metadata receiver using the CLI:
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Enable metadata streaming on the appliance.
hostname (config) # datastreaming configuration enable
Enable metadata streaming for an Rsyslog receiver.
hostname (config) # datastreaming configuration protocol rsyslog enable
Specify the name of the Rsyslog receiver to receive the metadata streaming events.
hostname (config) # datastreaming configuraton protocol rsyslog consumers <service-name>
Enable the Rsyslog receiver to receive the metadata streaming events.
hostname (config) # datastreaming configuraton protocol rsyslog consumers <service-name> enable
Specify the Rsyslog receiver protocol setting. You can choose from TCP, UDP, or SSL.
hostname (config) # datastreaming configuraton protocol rsyslog consumers <service-name> protocol {tcp | udp | ssl}Specify the Rsyslog receiver port to which data is streamed.
hostname (config) # datastreaming configuraton protocol rsyslog consumers <service-name> port <port-number>
Specify the Rsyslog receiver format used for metadata streaming.
hostname (config) # datastreaming configuraton protocol rsyslog consumers <service-name> format {ietf | snare | bsd}Specify the fully qualified domain name or IPv4 address.
hostname (config) # datastreaming configuration protocol rsyslog consumers <service-name> fqdn <fqdn | ipv4-address>
(Optional) Enable SSL verification on the Rsyslog receiver.
hostname (config) # datastreaming configuration protocol rsyslog consumers <service-name> ssl verify enable
(Optional) Specify minimum version of the TLS protocol to secure metadata streaming on the Rsyslog receiver.
hostname (config) # datastreaming configuration protocol rsyslog consumers <service-name> ssl min-version {TLSv1 | TLSv1.1 | TLSv1.2}Specify the list of supplemental certificates of authority (CA) that is to be used for the Rsyslog receiver. (Required if SSL verification is enabled.)
hostname (config) # datastreaming configuration protocol rsyslog consumers <service-name> ssl ca-list {none | default-ca-list}Verify the changes.
hostname (config) # show datastreaming configuration data-streaming configuration: Feature enabled : yes HTTP enabled : yes Rsyslog enabled : yes Helix Configuration: Helix enabled : no Helix FQDN : Helix bootstrap certificate : Subscribed rsyslog consumers : 1 Subscriber 01 of type: rsyslog: Name = rsyslog_receiver enable = yes protocol = tcp port = 514 fqdn = ex_example.com format = bsd ssl-verify = no ssl min version = TLSv1.2 ssl supplemental CA list = none hostname (config) #
Save the changes to the current active configuration.
hostname (config) # write memory