Configure ESA C190 to push Syslogs to multiple collectors

[Rachel Bautista]

We have two Cisco IronPort ESA C190s on OS 10.0.1-087.  

Our Security team has a requirement that we begin pushing syslogs to our SIEM device (Logrythm).  Our team currently pushes syslogs to our infrastructure management collector (Loginsight).

I need to be able to push syslogs to both locations.  I don't see a way to do it in the GUI, can it be done via commandline?

The issue is that our team doesn't have access to the security team's SIEM device so I can't use those logs to troubleshoot issues so I need both OR I need verification that only one can be used so they have a compelling reason to grant me access.

[Ken Stieers]

Create multiple log subscriptions, one pointed at each destination.

It's under System Administration/Log Subscriptions.

[Rachel Bautista]

Sorry, that didn't answer my question.  I need to know how to configure MULTIPLE syslog collectors.

I am well aware of how to configure it to push syslogs in general via the GUI.

[Ken Stieers]

You can't create one log sub and send it to multiple places.

You have to create a new log subscription for each destination.

The Logtype can be the same, the log name/logfile name have to be different, and the "Retrieval Method" is Syslog push will go to different IPs.

[Rachel Bautista]

Just to clarify, I can add a second subscription to a log type I already have listed and set it to go to a different syslog location?

Will it create the new log file or do I have to manually give it a different file name?

[Ken Stieers · Accepted solution]

Yes, you can add one for a log you already have.

You'll have to give it a new log name. (aka the directory)

You can use the same file name if you want (since it will be going to a different directory)

[Rachel Bautista]

I'll try that. Thanks!