I am configuring our SourceFire 3ds system to forward syslog information to LEM.
The default facility in SourceFire is alert, the LEM connector by default has a path of /var/log/alert.log
When I perform a checklog command on the appliance there is no alert log listed in the available files. Does this get created on its own somehow?
Can you create your own? Or do you just change the facility and log path to match one of the log locations listed.
thanks