Device Integration: Linux Apache Web Server

TABLE OF CONTENTS

• Prerequisites
• Admin (root) access to the Linux server.
• Configuration Steps
  • For CentOS
  • For Ubuntu
• Add CCE Forwarding Rule
• Verification (MSSP Only)
  • On ADR UI
  • On CCE Server

This guide explains how to configure a Linux server to forward logs to ADR SIEM (aiSIEM/aiXDR) using the Collection and Control Engine (CCE). Rsyslog forwarding (UDP 514) enables Linux application/server logs to be ingested into ADR for centralized visibility, security monitoring, and threat detection.

Prerequisites

• Admin (root) access to the Linux server.

• Installed rsyslog service (default in most Linux distributions).

• IP address of the ADR CCE server.

• Ensure UDP 514 is open between the Linux server and CCE.

Configuration Steps

Step 1: Edit rsyslog Configuration

• Log in as root on the Linux server and edit the rsyslog config file

vi /etc/rsyslog.conf

• Enable File Monitoring

For CentOS

Add the following lines:

$ModLoad imfile
#### GLOBAL DIRECTIVES ####
$InputFileName /var/log/httpd/access_log
$InputFileTag apache-access:
$InputFileStateFile state-apache-access
$InputRunFileMonitor

For Ubuntu

Add the following lines

$ModLoad imfile
#### GLOBAL DIRECTIVES ####
$InputFileName /var/log/apache2/access.log
$InputFileTag apache-access:
$InputFileStateFile state-apache-access
$InputRunFileMonitor

Adjust the log file path depending on which logs you want to forward 

Add CCE Forwarding Rule

At the end of rsyslog.conf, add:

*.* @<CCE_Server_IP>:514

• Restart rsyslog

Restart rsyslog to apply changes

service rsyslog restart

Verification (MSSP Only)

On ADR UI

1. Log in to ADR SIEM UI.
2. Navigate: System → Logs and Flows Collection Status.
3. Confirm the Linux server’s IP is listed under Source Device IP.

On CCE Server

Run:

sudo tcpdump -i any port 514 and host <Linux_Server_IP> -AAA