XSH how to redirect events to an alternate collector

• Related Articles

• XMA: How do I configure a FILTER to send EMS data to a SIEM from an alternate collector?

  This can be done by setting a filter and specifying an install location for the EMS collector. The INSTALL.LOCATION keyword specifies the installation location of the product (XAC, B24, EMS etc.) that is generating the even. With the exception of ...

• XMA: Changing the spooler collector for an XMA database cleanup or archive job

  To change the name of the spooler collector used for an existing XMA database cleanup or archive job: 1. Edit the MACONF file and change the COLLECTOR value to the desired spooler collector name 2. Enter SQLCI and delete the existing collector ...

• XMA - Permanently changing the collector for an XMA database cleanup or archive job

  1. Edit the MACONF file and change the COLLECTOR value to the desired spooler collector name 2. Enter SQLCI and delete the existing collector information for any XMA auto-cleanup, or auto-archive job from the PARAMS table: a. volume $<vol>.XMADAT ...

• XSH: How to manually start SSHD.

  Manually start SSHD, enter the following statements in an OSH session in the subdirectory XYGATESH was installed in: /users/<username>: cd /usr/local/sbin /usr/local/sbin: export XSHPRI=<Value> /usr/local/sbin: ./start-sshd Example: /users/xypro: cd ...

• XMA: Events sent to SIEM are not delimited

  1. Check the IPALERT_MSGDELIMITER setting for the filter is correct. This value must match what is expected on the SIEM side and should be provided by the SIEM administrator 2. Check the ACTIONTYPE value is correct. a. If the SIEM is expecting TCP ...