Creating fixlet for my archsight log

Content Authoring
1

Hello all,

I want to create a fixlet that can help me pool out logs from my Linux machines to my SIEM.

If I am to do this manually, the steps will involve the following:

  1. Log into the machine.
  2. Open the /etc/syslog.conf file.
  3. Add *.info@192.168.5.6 to the file
  4. Save the file.
  5. Restart the service using the command service syslog restart.

Please, How do I automate this tasks using BigFix?

2

See if the method for appending to the hosts file is re-usable for your use case. Just need to change the file and line being inspected for, and if you prefer, just keep the parts relevant to the Linux platform.

All you may need to then do is add the command to restart the syslog service

1 Like