Table of Contents

• Overview
• Steps of configuration
• Verification (MSSP Only)

Overview

To collect syslog audit events from your IBM AIX Server device, redirect your audit log output from your IBM AIX device to ADR.

Steps of configuration

1. Log in to your IBM AIX appliance as a root user.
2. Open the /etc/syslog.conf file.
3. To forward the system authentication logs to ADR, add the following line to the file:

   *.* @CCE IP Address

4. Save and exit the file.

5. Restart the syslog service:

refresh -s syslogd

Verification (MSSP Only)

sudo tcpdump -i any port 514 and host <IP Of AIX>.