Groupwise Logging

Question

Hi all
I am a tech guy , works on a SIEM product to integrate groupwise 2012 with our SIEM product.for that i have been trying to analysis the logs which has been logged by groupwise agents.but no luck yet whatever i have tried with....
there are the procedure i tried
Installed eDirectory on SLES11
installed groupwise on SLES 11
configured groupwise for basic functions ,such as send and receive emails between mail boxes..it works !!!!
i have configure MTA message logging by using these setting
logging level :verbose
Message log path :left it as default
and checked all four options to get all logs to be written in log files.
Delete report after: 10 days
done for POA also
changed the logging level to verbose
ok,coming to the problem,
1.logs are being written to MTA and POA log files but logs are just configuration logs ,,
2.i have restarted rcgroupwise agents not log is written which mentions like agent goes down or up ,,nothing i found like that
3.and i have moved database file from installation directory to check whether POA and MTA fails to start,agents failed to start even though logs are not written ,,
please currect me if i have missed any configurations or guide me if i am in wrong ,,,thanks ,,hop u all understood my Question\
responses would be highly appreciated
Thanks

Answer 1

A SIEM usually cares about security events (I'm sure you know this... just
making a point)), and GW's logs are logs, not audits, so they focus more
on functionality of the system internally, primarily for troubleshooting
purposes. Trying to pull out security-related data maybe possible, but
the vast majority of what is in the verbose logs will be junk in a SIEM.
I believe there is an enhancement request in to add a proper auditing
method, whether that be a file or sending out onto the wire, but I have
not seen that feature released (not that I've gone looking lately).
Good luck.
If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below...