How to enable Syslog Logging for Symantec Data Loss Prevention

You have the option to send severe DLP system events to a syslog server. To do this you must modify the configManager.properties file.

Note: You can configure DLP to send email notifications of severe system events. For details, open the DLP online help and go to Administration > System > Alerts > Alerts Overview.

To enable syslog logging:

1. Locate and open the configManager.properties file.
2. Uncomment the following lines:
   • #systemevent.syslog.host=
   • #systemevent.syslog.port=
   • #systemevent.syslog.format= [{0.EN_US}] {1.EN_US} – {2.EN_US}
3. Type values for each of these parameters, as follows:
   • host—syslog server host or IP address
   • port—syslog server port number (default is 514)
   • format—log file message format. Specify one or more of the following indicators:

{0.EN_US}—includes the name of the server on which the event occurred

{1.EN_US}—includes a brief summary of the event