3 Replies Latest reply on Feb 6, 2014 1:20 PM by evanr

    LEM -- add new node

    jjoubran

      Hello,

       

      I have installed LEM v 5.7.0 for testing. 

       

      As a first step, I am trying to add a new node (Cisco router) but it's failing. I have configured the router to send syslog and I can see the packets using wireshark.

      However, the device doesn't appear on the web interface. I get the following message:

      No nodes found

      LEM has not found any new nodes or connectors in the Syslog files that are being monitored.

      If you are expecting messages from new nodes, please check to make sure the device is configured correctly to send Syslog messages to LEM. It may also take some time for the node to send a Syslog message.

       

      What am I missing? I have followed the steps mentioned in the tutorial.

       

      Thanks,

      Justine.

        • Re: LEM -- add new node
          evanr

          For network devices you need to go to manage -> appliances.  Then set up your connector from there.  Make sure the logging facility line in your router matches the log file.

           

          logging facility local2

          Capture.JPG

           

          Then you need to set up a filter to capture the traffic.  The easiest is to set up a new filter and choose any alert -> tool alias = "ASA" to match your connector alias.  Alert.ToolAlias = *ASA*. 

          1 of 1 people found this helpful
            • Re: LEM -- add new node
              jjoubran

              Thanks for the reply,

               

              I didn't find where I can create the filter. Can you provide more details?

              I have a connector already created and it is connected (I didn't create it).

               

              Thanks,

              Justine.

                • Re: LEM -- add new node
                  evanr

                  Monitor -> Filters -> + sign -> new filter.  Then under event groups highlight any alert and below that choose tool alias and drag it to your conditions.  So it should read Any Alert.ToolAlias = (This is where you want to put the name of your alias in the connector).  Name it and save it and you should start to see logs coming in provided your network device & connector are set up correctly.