Sun Solaris OS

Sun Solaris OS DSM Specifications

When you configure the Sun Solaris OS, understanding the specifications for the Sun Solaris OS DSM can help ensure a successful integration. For example, knowing what the supported version of Sun Solaris OS is before you begin can help reduce frustration during the configuration process.

The following table describes the specifications for the Sun Solaris OS DSM.

Table 1: Sun Solaris OS DSM Specifications

Specification	Value
Manufacturer	Sun
DSM name	Sun Solaris OS
RPM file name	DSM-SunSolarisOS-JSA_versionbuild_number.noarch.rpm
Supported version	Sun OS 5.8, 5.9
Protocol	Syslog
Event format	All events
Automatically discovered?	Yes
Includes identity?	Yes
Includes custom properties?	No

Configuring Sun Solaris OS to Communicate with JSA

The Sun Solaris OS DSM for JSA records all relevant Solaris Operating System Authentication Messages events by using the Syslog protocol.

To collect events from Sun Solaris OS, you must configure syslog to forward events to JSA.

1. Log in to the Sun Solaris command-line interface (CLI).

2. Open the /etc/syslog.conf file.

3. To forward system authentication logs to JSA, add the following line to the file:

   *.err;auth.notice;auth.info@<IP_address>

   Where <IP_address> is the IP address of your JSA Console or Event Collector. Use tabs instead of spaces to format the line.

   Tip:

   Depending on your version of Sun Solaris, you might need to add more log types to the file. Contact your system administrator for more information.

4. Save and exit the file.

5. Type the following command:

Configure a log source in JSA. For more information, see Syslog Log Source Parameters for Sun Solaris OS.

Note:

If a Linux log source is created for the Solaris System that is sending events, disable the Linux log source, and then adjust the parsing order. Ensure that the Sun Solaris OS DSM is listed first.

Syslog Log Source Parameters for Sun Solaris OS

If JSA does not automatically detect the log source, add a Sun Solaris OS log source on the JSA Console by using the Syslog protocol.

When you use the Syslog protocol, there are specific parameters that you must configure.

The following table describes the parameters that require specific values to collect Syslog events from Sun Solaris OS:

Table 2: Syslog Log Source Parameters for the Sun Solaris OS DSM

Parameter	Value
Log Source type	Sun Solaris Operating System Authentication Messages
Protocol Configuration	Syslog
Log Source Identifier	A unique name for the log source. The Log Source Identifier can be any valid value and does not need to reference a specific server. The Log Source Identifier can be the same value as the log source Name. If you have more than one Sun Solaris OS log source that is configured, you might want to identify the first log source as solarisos1, the second log source as solarisos2, and the third log source as solarisos3.

Sun Solaris OS Sample Event Messages

Use these sample event messages to verify a successful integration with JSA.

Note:

Due to formatting issues, paste the message format into a text editor and then remove any carriage return or line feed characters.

Table 3: Highlighted Values in the Sun Solaris OS Sample Event Message

JSA field name	Highlighted values in the event payload
Event ID	login (inferred from the event content)
Source IPv6	2001:DB8:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF
Source Port	51730
Username	testuser
Identity Username	testuser
Device Time	Oct 6 10:35:59 (extracted from date and time fields)

Sample 2: The following sample event message shows mail information events in Sun Solaris OS.

Table 4: Highlighted Values in the Sun Solaris OS Sample Event Message

JSA field name	Highlighted values in the event payload
Event ID	mail.info
Source IP	10.10.25.2
Destination IP	10.10.25.2
Device Time	Mar 1 17:32:05 (extracted from date and time fields)