Page Comparison

Introduction

The tag tags beginning with auth.secureauth.events identifies all log identify events generated by SecureAuth IdP. This procedure was implemented for version 9.1.

For information about SecureAuth IdP, see the vendor documentation online.

Tag structure

This technology uses a single tag to support the audit, debug, and error logs generated by SecureAuth IdP. The tag is simply auth.secureauth.events and the associated events are saved in Devo in a table of the same name. For more information, read more about Devo tags.

To set up the sending of SecureAuth events to your Devo domain:

1. Set up the Devo relay rule that applies the tag to the SecureAuth events.

2. Configure event sending from SecureAuth to the Devo relay.

Step 1: Set up the Devo relay rule

On your Devo Relay, you'll set up a relay rule that applies the auth.secureauth.events tag before forwarding the events to Devo in syslog format. In the example below, we use port 13003 but you should use any port that you can dedicate to these events. This must be the same port you configure for the Syslog server in the next step..

• Source Port → 13003

• Target Tag → auth.secureauth.events

• Check the Stop processing checkbox.
  

Step 2: Configure event sending in SecureAuth IdP

In SecureAuth, you need to enable the sending of the audit, debug, and error logs in syslog format, then set up your Devo relay as a syslog server. To do so, follow the vendor instructions for log configuration, and be sure to:

• In the Log Options section, select the Syslog checkbox for each of the audit, debug, and error logs.

• In the Syslog section, enter the Devo relay's IP address as the Syslog server and the port to which you will send the events. Note that this is the port for which you will set up the relay rule later in this procedure. Select RFC3164 as the Syslog RFC Spec and choose CEF as the Spec format.

Once events are being sent from SecureAuth to the Devo relay, the auth.securauth.events table will appear in Devo in Data Search → Finder.the SecureAuth authentication platform.

Valid tags and data tables 

The full tag must have 3 levels. The first two are fixed asauth.secureauth. The third level identifies the type of events sent.

These are the valid tags and corresponding data tables that will receive the parsers' data:

For more information, read more About Devo tags.

Table structure

These are the fields displayed in these tables:

• auth.secureauth.events

• auth.secureauth.radius

Anchor
tag1 tag1

auth.secureauth.events

split(hostchain, "=", 0)

Anchor
tag2 tag2

auth.secureauth.radius

Related articles

• SecureAuth IdP 9.1 Documentation

• About Devo tags

• Scenario 1: Apply a fixed tag to all events