Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Configuring JDBC to Collect Samhain Events

 

You can configure Samhain HIDS to send log alerts to a database. Oracle, PostgreSQL, and MySQL are natively supported by Samhain.

You can also configure JSA to collect events from these databases by using the JDBC protocol.

Note

JSA does not include a MySQL driver for JDBC. If you are using a DSM or protocol that requires a MySQL JDBC driver, you must download and install the platform independent MySQL Connector/J from http://dev.mysql.com/downloads/connector/j/.

  1. Log into JSA.
  2. Click the Admin tab.
  3. On the navigation menu, click Data Sources.
  4. Click the Log Sources icon.
  5. Click Add.
  6. From the Log Source Type list, select the Samhain HIDS option.
  7. Using the Protocol Configuration list, select JDBC.
  8. Update the JDBC configuration to include the following values:
    1. Database Type: <Samhain Database Type>

    2. Database Name: <Samhain SetDBName>

    3. Table Name: <Samhain SetDBTable>

    4. Select List: *

    5. Compare Field: log_index

    6. IP or Hostname: <Samhain SetDBHost>

    7. Port: <Default Port>

    8. Username: <Samhain SetDBUser>

    9. Password: <Samhain SetDBPassword>

    10. Polling Interval: <Default Interval>

    Where:

    • <Samhain Database Type> is the database type that is used by Samhain (see your Samhain system administrator).

    • <Samhain SetDBName> is the database name that is specified in the samhainrc file.

    • <Samhain SetDBTable> is the database table that is specified in the samhainrc file.

    • <Samhain SetDBHost> is the database host that is specified in the samhainrc file.

    • <Samhain SetDBUser> is the database user who is specified in the samhainrc file.

    • <Samhain SetDBPassword> is the database password that is specified in the samhainrc file.

  9. You can now configure the log source in JSA. To configure JSA to receive events from Samhain: From the Log Source Type list, select the Samhain HIDS option.

    For more information about Samhain, see http://www.la-samhna.de/samhain/manual.