Quantcast
Channel: THWACK: Message List - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5385

Re: How to get Windows 10 system with a Docker Container sending logs to the SEM?

$
0
0

Haven't played with docker in Windows, but ultimately I imagine it's going to need to work about the same as a regular Windows machine would or it won't work (I didn't see anything specific to Docker support for the SEM agent).

 

So firstly, if you want to look at the host name sending logs, you may need to check the details on where the agent would acquire the name (spoiler alert, it's from the system, so likely it's just taking the name of your docker/environmental variables):

 

Success Center

 

That article details a few switches you can try to get the name you would expect, or maybe find and update the source to be what you'd expect.

 

If you're not interested in getting the logs directly after all, then you need to make sure that the containers are passing through the logs. The agent is going to read the logs of the local System/Application/Security I'd imagine, so unless the containers are writing their logs to the root machine somehow, I'm not sure how the agent would see them.


Viewing all articles
Browse latest Browse all 5385

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>