HIDS v.4.0 Template Creation.

[Derek Whigham_1]

I am looking to create a new HIDS Template to monitor syslog events and raise them in the HIDS GUI. Is there away to get syslog events to appear in the HIDS GUI an API or do I need a new template

[Pierre Pasturel · Accepted solution]

Hi Derek -

HIDS does not monitor syslog and can not be configured to do so. This is actually the second request for syslog support by HIDS (http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1020650).

I would check out the syslog-ng feature of DSAU
http://docs.hp.com/en/5991-2710/ch05s02.html

Let me know if syslog monitoring by HIDS is still preferable, and if so, what your requirements are for such a feature in HIDS.

Pierre

[Derek Whigham_1]

I think the ability to filter and forward syslog(ng) events into the hids gui would be a useful addition the hids funcionality , At the momnet I am trying to meet SOX 404 requirements and I would like a single point of log consolidation. I think I will have to forward HIDS events to syslog and monitor syslog using one of the GPL syslog GUI's

Thanks for your Help