Follow the steps below to setup log signing in EventSentry:
Setting up the log storage
Determine where the log text file should be stored. This can be a local or remote folder (SMB) and needs to have sufficient disk space to store some or all of your log data.
If the folder is on a remote system then make sure that the computer account of the host running EventSentry has sufficient permissions to add files to the destination folder. Computer account names usually end with the $ character.
If the logs are stored on a local folder or drive then it's recommend to encrypt the volume with Bitlocker.
Setting up action
Log Signing requires the a "File" action which stores either event log or Syslog data in the files to be created. Checking the "Digitally Sign Files" box will sign the created files - either by the collector (event log records) or by the network services (Syslog data).
The dialog will show the "Initialize" button if log signing has not been initialized yet - see "Initialization" below.
|
Do not use the same action when signing both event log and Syslog data - separate actions should be used. |
Initialization
Log Signing can be initialized by clicking the "Initialize" button on a file action dialog. If initializing from the management console does not work, or you prefer to do a manual initialization then follow the steps below:
Open an administrative command prompt and navigate to the scripts\logsigning sub folder of the EventSentry installation directory, for example
C:\Program Files\EventSentry\scripts\logsigning
There, execute the script
log_init.cmd
which should create the following 4 files:
C:\Program Files\EventSentry\logsigning\es_logsign_private.pem
C:\Program Files\EventSentry\logsigning\es_logsign_public.pem
C:\Program Files\EventSentry\logsigning\freetsa\cacert.pem
C:\Program Files\EventSentry\logsigning\freetsa\tsa.crt
|
Do not copy, share or distribute the es_logsign_private.pem file to anyone, as it contains the private key with which log data will be signed. |
Setting up filters / Syslog
Depending on the requirements, either all or some event logs can be exported to files. As such, either setup a new event log filter with the "File" action as the target (here called "Logs To Sign"), or modify an existing filter - e.g. "Database Consolidation\Consolidate Audit Success".
To sign Syslog data, a separate Text File action can be created and referenced under Network Services - Syslog - Database. Please note that - regardless of the log file type - Syslog data will always be saved in CSV format.
