Cisco CES
Run the CLI command logconfig.
Select the option new.
Choose the log file type for this subscription, this will be "1" for IronPort Text Mail Logs, or any other log file type of your choice.
Enter the name for the log file.
Select the appropriate log level. Typically you would need to select "3" for Informational, or any other log level of your choice.
When prompted 'Choose the method to retrieve the logs', select "3" for SCP Push.
Enter in the IP address or DNS hostname to deliver the logs to.
Enter the port to connect to on the remote host.
Enter the directory on remote host to place logs.
Enter in a filename to use for log files.
Configure, if needed, system based unique identifiers like $hostname, $serialnumber to append to the log filename.
Set Maximum filesize before transferring.
Configure time-based rollover of the log files, if applicable.
When asked "Do you want to enable host key checking?", enter "Y".
You are then presented the "Please place the following SSH key(s) into your authorized_keys file so that the log files may be uploaded."
Copy that key, as you will need to put the SSH key in your 'authorized_keys' file on the Syslog server. Paste the key given from logconfig to $HOME/.ssh/authorized_keys file on the Syslog server.
From the ESA, run the CLI command commit to save and commit configuration changes
Last updated