{"id":6003,"date":"2020-11-20T15:36:41","date_gmt":"2020-11-20T15:36:41","guid":{"rendered":"https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/"},"modified":"2022-06-29T07:34:48","modified_gmt":"2022-06-29T07:34:48","slug":"generating-syslog-messages-from-symantec-data-loss-prevention","status":"publish","type":"epkb_post_type_1","link":"https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/","title":{"rendered":"Generating Syslog messages from Symantec Data Loss Prevention"},"content":{"rendered":"<p>DLP supports two methods for generating Syslog events:\u00a0&#8220;Syslog Response Rule&#8221; notifications and &#8220;Syslog Server Alerts&#8221;.<\/p>\n<ol>\n<li>Creating a Syslog Response Rule\n<ul>\n<li>When creating an Automated Response Rule, select \u2018Log to a Syslog Server\u2018 as the action. Fill in the Host, Port, Message, and Level as appropriate. Once assigned to a Policy, the Response Rule will generate a syslog event when triggered.\n<ul>\n<li><em>The creation of a &#8220;Syslog Response Rule&#8221; does\u00a0<strong>not\u00a0<\/strong>require the additional method described for &#8220;Syslog Server Alerts&#8221; &#8211; they are separate functions.<\/em><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>Create Syslog Server Alerts<\/li>\n<\/ol>\n<p>The System Maintenance Guide outlines how to setup Syslog events.<\/p>\n<h3>To enable syslog functionality<\/h3>\n<ol>\n<li>Navigate to the installed directory, for example\u00a0<code>&lt;drive&gt;:SymantecDLPProtectconfig<\/code>\u00a0directory on Windows or the\u00a0<code>\/opt\/SymantecDLP\/Protect\/config<\/code>\u00a0directory on Linux.<\/li>\n<li>Open the\u00a0<code>Manager.properties<\/code>\u00a0file.<\/li>\n<li>Uncomment the\u00a0<code>#systemevent.syslog.host=<\/code>\u00a0line by removing the\u00a0<code>#<\/code>\u00a0symbol from the beginning of the line and enter the hostname or IP address of the syslog server.<\/li>\n<li>Uncomment the\u00a0<code>#systemevent.syslog.port=<\/code>\u00a0line by removing the\u00a0<code>#<\/code>\u00a0symbol from the beginning of the line and enter the port number that should\u00a0accept connections from the Vontu Enforce server. The default is\u00a0<code>514<\/code>. This is UDP.<\/li>\n<li>Uncomment the\u00a0<code>#systemevent.syslog.format= [{0.EN_US}] {1.EN_US} - {2.EN_US}<\/code>\u00a0line by removing the\u00a0<code>#<\/code>\u00a0symbol from the beginning of the line and define the system event message format.<\/li>\n<\/ol>\n<p>The optional parameters are as follows:<\/p>\n<blockquote dir=\"ltr\"><p>\u00a0 {0.EN_US} &#8211; name of the server on which the event occurred<br \/>\n{1.EN_US} &#8211; event summary<br \/>\n{2.EN_US} &#8211; event detail<\/p><\/blockquote>\n<p>For example, in the following configuration:<\/p>\n<blockquote dir=\"ltr\"><p>systemevent.syslog.host=galapagos.company.com<br \/>\nsystemevent.syslog.port=600<br \/>\nsystemevent.syslog.format= [{0.EN_US}] {1.EN_US} &#8211; {2.EN_US}<\/p><\/blockquote>\n<p>System event notifications would be written to a server named\u00a0<code>galapagos.company.com<\/code>\u00a0using port 600 and the notification messages will be in the following format:<\/p>\n<blockquote dir=\"ltr\"><p>[server name] summary \u2013 details<\/p><\/blockquote>\n<p>If galapagos was used to host an Enforce server, an event notification indicating low disk space on galapagos might look like this:<\/p>\n<blockquote dir=\"ltr\"><p>[Enforce server] Low disk space &#8211; Hard disk space for incident<br \/>\ndata storage server is low. Disk usage is over 82%.<\/p><\/blockquote>\n<h3><\/h3>\n<h4>DLP 15.0 and later<\/h4>\n<p>You have the ability to set the log level to include INFO and WARNING along with SEVERE.<\/p>\n<p>For reference:<\/p>\n<ul>\n<li>Log level 3 = logs SEVERE messages only (this is default)<\/li>\n<li>Log level 4 = Logs SEVERE and WARNING<\/li>\n<li>Log level 5 = logs INFO, WARNING, SEVERE<\/li>\n<\/ul>\n<p>Steps to implement:<\/p>\n<ol>\n<li>Install\/Upgrade to DLP 15.0 on your system.<\/li>\n<li>Open manager.properties as indicated above.<\/li>\n<li>Find the following line: \u00a0<code>systemevent.syslog.level = x\u200b<\/code><\/li>\n<li>Change the value of x to either 3, 4, or 5 (the default value is 3)<\/li>\n<li>Restart services for changes to take effect in\u00a0Windows\u00a0or\u00a0Linux.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>DLP supports two methods for generating Syslog events:\u00a0&#8220;Syslog Response Rule&#8221; notifications and &#8220;Syslog Server Alerts&#8221;. Creating a Syslog Response Rule When creating an Automated Response Rule, select \u2018Log to a Syslog Server\u2018 as the action. Fill in the Host, Port, Message, and Level as appropriate. Once assigned to a Policy, the Response Rule will generate [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"epkb_post_type_1_category":[47],"epkb_post_type_1_tag":[],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Generating Syslog messages from Symantec Data Loss Prevention | Cloudrise<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Generating Syslog messages from Symantec Data Loss Prevention | Cloudrise\" \/>\n<meta property=\"og:description\" content=\"DLP supports two methods for generating Syslog events:\u00a0&#8220;Syslog Response Rule&#8221; notifications and &#8220;Syslog Server Alerts&#8221;. Creating a Syslog Response Rule When creating an Automated Response Rule, select \u2018Log to a Syslog Server\u2018 as the action. Fill in the Host, Port, Message, and Level as appropriate. Once assigned to a Policy, the Response Rule will generate [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/\" \/>\n<meta property=\"og:site_name\" content=\"Cloudrise\" \/>\n<meta property=\"article:modified_time\" content=\"2022-06-29T07:34:48+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/\",\"url\":\"https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/\",\"name\":\"Generating Syslog messages from Symantec Data Loss Prevention | Cloudrise\",\"isPartOf\":{\"@id\":\"https:\/\/www.cloudrise.com\/#website\"},\"datePublished\":\"2020-11-20T15:36:41+00:00\",\"dateModified\":\"2022-06-29T07:34:48+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.cloudrise.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Generating Syslog messages from Symantec Data Loss Prevention\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.cloudrise.com\/#website\",\"url\":\"https:\/\/www.cloudrise.com\/\",\"name\":\"Cloudrise\",\"description\":\"Cloudrise Data Protection and Privacy Services\",\"publisher\":{\"@id\":\"https:\/\/www.cloudrise.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.cloudrise.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.cloudrise.com\/#organization\",\"name\":\"Cloudrise\u2122\",\"url\":\"https:\/\/www.cloudrise.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.cloudrise.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.cloudrise.com\/wp-content\/uploads\/2022\/05\/logo-dark-1.png\",\"contentUrl\":\"https:\/\/www.cloudrise.com\/wp-content\/uploads\/2022\/05\/logo-dark-1.png\",\"width\":272,\"height\":113,\"caption\":\"Cloudrise\u2122\"},\"image\":{\"@id\":\"https:\/\/www.cloudrise.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/cloudrise-inc\/\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Generating Syslog messages from Symantec Data Loss Prevention | Cloudrise","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/","og_locale":"en_US","og_type":"article","og_title":"Generating Syslog messages from Symantec Data Loss Prevention | Cloudrise","og_description":"DLP supports two methods for generating Syslog events:\u00a0&#8220;Syslog Response Rule&#8221; notifications and &#8220;Syslog Server Alerts&#8221;. Creating a Syslog Response Rule When creating an Automated Response Rule, select \u2018Log to a Syslog Server\u2018 as the action. Fill in the Host, Port, Message, and Level as appropriate. Once assigned to a Policy, the Response Rule will generate [&hellip;]","og_url":"https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/","og_site_name":"Cloudrise","article_modified_time":"2022-06-29T07:34:48+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/","url":"https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/","name":"Generating Syslog messages from Symantec Data Loss Prevention | Cloudrise","isPartOf":{"@id":"https:\/\/www.cloudrise.com\/#website"},"datePublished":"2020-11-20T15:36:41+00:00","dateModified":"2022-06-29T07:34:48+00:00","breadcrumb":{"@id":"https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.cloudrise.com\/knowledge-base\/generating-syslog-messages-from-symantec-data-loss-prevention\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.cloudrise.com\/"},{"@type":"ListItem","position":2,"name":"Generating Syslog messages from Symantec Data Loss Prevention"}]},{"@type":"WebSite","@id":"https:\/\/www.cloudrise.com\/#website","url":"https:\/\/www.cloudrise.com\/","name":"Cloudrise","description":"Cloudrise Data Protection and Privacy Services","publisher":{"@id":"https:\/\/www.cloudrise.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.cloudrise.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.cloudrise.com\/#organization","name":"Cloudrise\u2122","url":"https:\/\/www.cloudrise.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudrise.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.cloudrise.com\/wp-content\/uploads\/2022\/05\/logo-dark-1.png","contentUrl":"https:\/\/www.cloudrise.com\/wp-content\/uploads\/2022\/05\/logo-dark-1.png","width":272,"height":113,"caption":"Cloudrise\u2122"},"image":{"@id":"https:\/\/www.cloudrise.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/cloudrise-inc\/"]}]}},"_links":{"self":[{"href":"https:\/\/www.cloudrise.com\/wp-json\/wp\/v2\/epkb_post_type_1\/6003"}],"collection":[{"href":"https:\/\/www.cloudrise.com\/wp-json\/wp\/v2\/epkb_post_type_1"}],"about":[{"href":"https:\/\/www.cloudrise.com\/wp-json\/wp\/v2\/types\/epkb_post_type_1"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudrise.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudrise.com\/wp-json\/wp\/v2\/comments?post=6003"}],"version-history":[{"count":1,"href":"https:\/\/www.cloudrise.com\/wp-json\/wp\/v2\/epkb_post_type_1\/6003\/revisions"}],"predecessor-version":[{"id":6087,"href":"https:\/\/www.cloudrise.com\/wp-json\/wp\/v2\/epkb_post_type_1\/6003\/revisions\/6087"}],"wp:attachment":[{"href":"https:\/\/www.cloudrise.com\/wp-json\/wp\/v2\/media?parent=6003"}],"wp:term":[{"taxonomy":"epkb_post_type_1_category","embeddable":true,"href":"https:\/\/www.cloudrise.com\/wp-json\/wp\/v2\/epkb_post_type_1_category?post=6003"},{"taxonomy":"epkb_post_type_1_tag","embeddable":true,"href":"https:\/\/www.cloudrise.com\/wp-json\/wp\/v2\/epkb_post_type_1_tag?post=6003"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}