Configuring Centrify Infrastructure Services on a UNIX or Linux Device to Communicate with JSA
You can configure your UNIX or Linux device to send audit events to JSA. The audit events are available locally in the syslog event logs where the Centrify Infrastructure Services is installed and configured.
- Log in to your Centrify Infrastructure Services device.
- Ensure that syslog or rsyslog is installed.
To verify that syslog is installed, type service syslog status.
To verify that rsyslog is installed, type service rsyslog status.
- If syslog or rsylog is not installed, install them by
using your preferred method based on your Unix or Linux device. For
example, you can type the following command to install rsyslog on
a Linux device:
yum install rsyslog
- To forward events to your JSA Event Collector, open the
rsyslog.conffile or the
syslog.conffile that is located in
/etc/directory, and then add the following line:
:msg, contains, "AUDIT_TRAIL" @@<JSA Event Collector IP>:514
- Restart the syslog or rsyslog service.
If you are using syslog, type service syslog restart.
If you are using rsylog, type service rsyslog restart.
Centrify Linux agent might forward some Linux system messages along with the Audit Trail logs. If no specific category is found, the Linux OS log source type in JSA discovers the Linux messages and normalizes them as stored.
Sample event message
Use this sample event message as a way of verifying a successful integration with JSA.
The following table shows sample event messages from Centrify Infrastructure Services:
Table 1: . Centrify Infrastructure Services Sample Message
Low level category
Sample log message
Remote login success
Remote Access Login Succeeded
The user logged in to the system successfully
User Login Success