Forwarding syslog FROM IMC TO another management tool

[cttripp1]

OK, so, I have all my network equipment sending syslog traffic to my IMC server, and everything is working fine.  I don't need help there.

But, I've been asked if there is any way for IMC to then transmit those same syslogs on to another management tool.  There is some SIEM (Security Information and Event Management) tool that the security team is using, and instead of reconfiguring all of the network equipment to send syslogs to the SIEM tool, they want IMC to just forward the syslogs it receives.

I know there is an feature that can export the syslogs to a CSV or HTML file, but that's not what I'm looking for.  I thought I read somewhere that IMC can forward syslog entries, but I can't find that document any more; I may have just imagined it.

Thanks!

[jguse · Accepted solution]

Hello,

Perhaps you are thinking of the Alarm Forwarding feature, which uses the IMC-MIB to forward alarms (as SNMP Traps) to another NMS. See also https://community.hpe.com/t5/IMC/iMC-forwards-alarm-to-a-different-NMS/td-p/6841901#.XQnzCogzaUk

There is no direct Syslog Forwarding feature, presumably because all devices that support syslog also support multiple destinations. Why not configure an additional syslog receiver on your devices? IMC CLI Script could make that really easy to deploy even on thousands of devices.

[cttripp1]

Thanks for the feedback.  I was afraid I had confused alarm forwarding with syslog forwarding, so thanks for clearing that up.  As for scripting, that's the best solution; I was just trying to avoid having to go through change control.  Thanks!