Follow these steps to modify an Rsyslog receiver for metadata streaming of Email Security - Server appliance email events:
To add an Rsyslog metadata receiver using the CLI:
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Change the Rsyslog receiver protocol setting.
hostname (config) # datastreaming configuraton protocol rsyslog consumers <service-name> protocol {tcp | udp | ssl}Change the Rsyslog receiver port to which data is streamed.
hostname (config) # datastreaming configuraton protocol rsyslog consumers <service-name> port <port-number>
Change the Rsyslog receiver format used for metadata streaming.
hostname (config) # datastreaming configuraton protocol rsyslog consumers <service-name> format {ietf | snare | bsd}Change the fully qualified domain name or IPv4 address.
datastreaming configuration protocol rsyslog consumers <service-name> fqdn <fqdn | ipv4-address>
Change the minimum version of the TLS protocol to secure metadata streaming on the Rsyslog receiver.
datastreaming configuration protocol rsyslog consumers <service-name> ssl min-version {TLSv1 | TLSv1.1 | TLSv1.2}(Optional) Specify the list of supplemental certificates of authority (CA) that is to be used for the Rsyslog receiver.
datastreaming configuration protocol rsyslog consumers <service-name> ssl ca-list {none | default-ca-list}Verify the changes.
hostname (config) # show datastreaming configuration data-streaming configuration: Feature enabled : yes HTTP enabled : yes Rsyslog enabled : yes Helix Configuration: Helix enabled : no Helix FQDN : Helix bootstrap certificate : Subscribed rsyslog consumers : 1 Subscriber 01 of type: rsyslog: Name = rsyslog_receiver enable = yes protocol = tcp port = 514 fqdn = ex_example.com format = bsd ssl-verify = no ssl min version = TLSv1.2 ssl supplemental CA list = none hostname (config) #
Save the changes to the current active configuration.
hostname (config) # write memory