This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

LEM -- add new node

FormerMember over 10 years ago

Hello,

I have installed LEM v 5.7.0 for testing.

As a first step, I am trying to add a new node (Cisco router) but it's failing. I have configured the router to send syslog and I can see the packets using wireshark.

However, the device doesn't appear on the web interface. I get the following message:

No nodes found

LEM has not found any new nodes or connectors in the Syslog files that are being monitored.

If you are expecting messages from new nodes, please check to make sure the device is configured correctly to send Syslog messages to LEM. It may also take some time for the node to send a Syslog message.

What am I missing? I have followed the steps mentioned in the tutorial.

Thanks,

Justine.

Top Replies

evanr over 10 years ago +1

For network devices you need to go to manage -> appliances. Then set up your connector from there. Make sure the logging facility line in your router matches the log file. logging facility local2 Then…

0 evanr over 10 years ago

For network devices you need to go to manage -> appliances. Then set up your connector from there. Make sure the logging facility line in your router matches the log file.
logging facility local2
Then you need to set up a filter to capture the traffic. The easiest is to set up a new filter and choose any alert -> tool alias = "ASA" to match your connector alias. Alert.ToolAlias = *ASA*.
Cancel
Vote Up +1 Vote Down

Cancel
0 FormerMember over 10 years ago in reply to evanr

Thanks for the reply,
I didn't find where I can create the filter. Can you provide more details?
I have a connector already created and it is connected (I didn't create it).
Thanks,
Justine.
Cancel
Vote Up 0 Vote Down

Cancel
0 evanr over 10 years ago in reply to FormerMember

Monitor -> Filters -> + sign -> new filter. Then under event groups highlight any alert and below that choose tool alias and drag it to your conditions. So it should read Any Alert.ToolAlias = (This is where you want to put the name of your alias in the connector). Name it and save it and you should start to see logs coming in provided your network device & connector are set up correctly.
Cancel
Vote Up 0 Vote Down

Cancel