Press CTRL+K to open search

SIEM Collector Installation Guide for Linux

  • Published on Sep 4, 2026
  • 4 minute(s) read
Prev Next

SIEM Collector for Linux

Send Linux events to a Trellix Enterprise Security Manager - Event Receiver.

Overview

The Trellix SIEM Collector for Linux adds a local agent to your system and sends the events to the Trellix Enterprise Security Manager - Event Receiver.

Key features

  • Linux event collection and forwarding

  • Can be configured and deployed through Trellix ePolicy Orchestrator - On-prem

SIEM Collector for Linux system requirements

The SIEM Collector runs on these Linux operating systems.

The operating system versions listed here are the latest releases to receive formal testing. Due to the self-contained nature of the SIEM Collector utility, Trellix expects that it will function normally with later operating system releases. There are no known issues with more recent versions of these operating systems.

  • Ubuntu 10.04

  • Redhat 5.8

  • Fedora 16

  • Suse 11

  • CentOS 5.9

  • CentOS 6.4

Install SIEM Collector for Linux from the command line

Before you begin

Download the SIEM Collector for Linux software package to the local computer.

Task

Open command line and enter:

  • rpm -U <package>.rpm for Red Hat operating system.

  • or

  • dpkg -i <package>.deb for Ubuntu operating system.

Note

The end-user license agreement is located at /usr/share/doc/trellix/.

The configuration file is copied from /opt/McAfee/siem/siem_collector.conf to /opt/Trellix/siem/siem_collector.conf and paths which contain McAfee are replaced with Trellix. The bookmarks file is also copied from /var/lib/mcafee/bookmarks/ft_bookmarks to /var/lib/trellix/bookmarks/ft_bookmarks.

Install SIEM Collector for Linux from Trellix ePolicy Orchestrator - On‑prem

Use Trellix ePolicy Orchestrator - On‑prem to set up SIEM Collector to generate event logs.

Before you begin

Download the SIEM Collector extension to the Trellix ePO - On‑prem server.

Task

  1. Log on to the Trellix ePO - On‑prem server as an administrator.

  2. Upload the file SIEMCollectorExtension.zip as a Trellix ePO - On‑prem extension.

  3. Upload the file SIEMCollectorPackage.zip to the Trellix ePO - On‑prem master repository.

  4. Push it out to the connected devices.

small blue pencil-in-square note icon

Note

See the Trellix ePolicy Orchestrator - On-prem documentation for more information.

SIEM Collector configuration file field descriptions

The fields that you need to populate when installing SIEM Collector for Linux.

Note

The configuration file is located at /opt/Trellix/siem/siem_collector.conf.

General Configuration

Field

Description

bookmark_dir

The directory where the bookmark file is saved.

debug_level

The level of debug output by the collector. Options are diag, debug, info, warn and error. The default option is info.

log_path

The directory where the log is written. The default path to log file is /var/log/trellix/siem_collector.log. When the log file reaches a set size, it will rotate to create up to five log files.

max_logfile_size

The maximum log file size is stored in megabytes before it rotates and the default value is 10 megabytes.

epo_logging

Specifies whether to include Trellix ePO - On-prem logging messages in the logs (1 = on, 0 = off).

sleep=x

If a file has not been modified since the SIEM Collector was last shut down, on startup it will put the file in a watch list and check on it from time to time. If there are files in the watch list, the SIEM Collector will check them every x seconds.

throttle=x

The number of events to read from a watched file before moving on to the next file to be read. The default value is 300.

epo_autogen_hostid

If this field is set then it recognizes the Trellix ePO - On-prem generate_hostid flag and sets the hostid to be <hostname>-<plugin name>. (1 = on, 0 = off).

# Collector

bookmark_dir=/var/lib/trellix/bookmark
debug_level=error
log_path=/var/log/trellix/siem_collector.log
max_logfile_size=20
epo_logging=1
sleep=5
throttle=300

Receiver Setting

Field

Description

rec_ip

The IP address of the receiver to send events to.

rec_port

The port that the receiver is listening on. The default is port 8082.

rec_encrypt

Enables or disables encryption (0 = off, 1 =on).

# Receiver

rec_ip=10.0.0.0
rec_port=8082
rec_encrypt=0

Plugin Settings

The filetail plugin type is the only type that is supported. You can have as many filetail sections as needed. The plugin start with the line type=command. A new plugin starts each time when this line is seen

green caution triangle icon Caution

The file to be tailed must be on the local system.

Field

Description

subtype

The subtype of the plugin.

hostid

                Enter a value to use a Host ID on the receiver.                

blue note icon Note: The host ID should match the datasource on the receiver to log the events, if it does not match the datasource then events are not logged.

ft_dir

The directory where the plugin will look for files to tail.

ft_filter

Filter which file to tail (for example, messages or log.*).

ft_delim

The delimiter that tells the Collector when a new event starts (<newline>, <space>, <tab>). Regular expressions are also supported.

ft_delim_end_of_event

Specifies whether the delimiter is located at the beginning or the end of the event (0 = beginning, 1 = end; default is 1).

ft_start_top

Specifies whether to start at the top of the file (0 = no, 1 = yes).

# Plugin

type=filetail
hostid=
ft_dir=/var/log
ft_filter=log.1
ft_delim=<newline>
ft_delim_end_of_event=1
ft_start_top=1

type=filetail
hostid=messages
ft_dir=/var/log
ft_filter=messages
ft_delim=<newline>
ft_start_top=1

Configure and run the SIEM Collector for Linux

The SIEM Collector configuration and run commands are listed for Linux based operations. You can make configuration changes to the config file before starting the SIEM Collector or you can stop the SIEM Collector, make config changes to the config file, and restart the SIEM Collector. To test the changes to the config file before reloading it, run the following command:

LD_LIBRARY_PATH=/opt/Trellix/siem/lib /opt/Trellix/siem_collector -c <path_to_config_file>

Change the SIEM Collector configuration

To change the SIEM Collector configuration, edit the config file and run the following command: kill -HUP $(pidof siem_collector).

Start the SIEM Collector

To start the SIEM Collector:

  • In the Systemd, run systemctl start siem_collector.

  • Otherwise, service siem_collector start or /etc/init.d/siem_collector start.

Restart the SIEM Collector

To restart the SIEM Collector:

  • In the Systemd, run systemctl restart siem_collector.

  • Otherwise, run service siem_collector restart or /etc/init.d/siem_collector restart.

Stop the SIEM Collector

To stop the SIEM Collector:

  • In the Systemd, run systemctl stop siem_collector.

  • Otherwise, run service siem_collector stop or /etc/init.d/siem_collector stop.

Check the SIEM Collector

To check the SIEM Collector whether it is running:

  • In the Systemd, run systemctl status siem_collector.

  • Otherwise, run pidof -q siem_collector && echo "running".

Related articles