Unable to see syslog event source logs from VLC in RSA Security Analytics

Issue

Although Syslog Event Source device is correctly configured to push logs to VLC and the events are received by VLC as confirmed by tcpdump capture with the command tcpdump -i any host , the logs (i.e. sessions) are not available in Investigation.

- No backlog messages for syslog queue in VLC as below.

 [root@XXXX ~]# rabbitmqctl list_queues -p logcollection consumers name messages
 
Listing queues ...
 
rabbitmq.log 0
 
shovel.checkpoint.test 0
 
shovel.cmdscript.test 0
 
shovel.file.test 0
 
shovel.netflow.test 0
 
shovel.odbc.test 0
 
shovel.sdee.test 0
 
shovel.snmptrap.test 0
 
shovel.syslog.test 0
 
shovel.vmware.test 0
 
shovel.windows.test 0

- No errors in /var/log/messages relevant to Event Source IP address.

Cause

This issue might be due to Syslog configuration not yet configured in VLC.

Resolution

Please follow below steps to get syslog logs in the investigation page.
1. Login to Security Analytics GUI as administrator.
2. Navigate to Administration->Services->VLC->view->Config->Event Sources->Syslog/Config.
3. Configure port number for both syslog-tcp and syslog-udp configuration as below.

TCP:

UDP:

4. Verify Investigation page to see syslog logs.

Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: SA Core Appliance, SA Virtual Log Collector
RSA Version/Condition: 10.5.X, 10.6.X

Summary

In a newly added VLC, Syslog configuration required to see logs collected by syslog collection.

Approval Reviewer Queue

ASOC Approval Group