App Control: How To Setup Logging Events to a Syslog Server
search cancel

App Control: How To Setup Logging Events to a Syslog Server

book

Article ID: 286708

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Setup Event Logging to an external syslog application.

Environment

  • App Control Console: All Supported Versions

Resolution

  1. Prepare the syslog application to ingest App Control event logs. See the Server Documentation > Supported Integrations section of the App Control documentation.
  2. Login to the App Control Console and navigate to: System Configuration > Events > Edit.
  3. In the section, "External Event Logging" check the box, "Syslog Enabled".
  4. Enter the relevant details for the syslog application (Syslog Address, Port, Format, etc).
  5. Click Update > review the changes > click Yes to apply the changes.

Additional Information

Currently it is not possible to filter the Events sent from App Control. Filtering should be done in the application ingesting the Events.