I have setup DVLS to send logs to SYSLOG and noticed that nothing about my login to DVLS web server was logged but my Connection to a VPN in RDM was logged. I really need more information on the SYSLOG data flow and what is sent to syslog.
Hello,
By default, the syslog receives the same information than the Email Administrator, if you also configured the email section. It is almost the same as under the Reports > Data Source Logs.
If you want more information to be sent, you can do so with the Notifications: https://helpserver.devolutions.net/webinterface_notifications.html
You can add a syslog subscriber, by changing the type, and you can then add the subscriptions that you desire.
Best regards,
Richard Boisvert
Is there any documentation on the Syslog Message Structure? I am having to do testing for the DVLS and RDM and need to Document all the Logging for our SEIM. It would help to have this documentation.
Hello,
The engineering team will provide us with the relevant information, and we will create a KB regarding the SIEM structure. I will update this thread once it is available.
Best regards,
Richard Boisvert
Still waiting for this is there an ETA?
Hello,
We have a new KB available for the Syslog. Make sure to expand the Message type and subtype at the start, they contain most of the relevant information.
https://kb.devolutions.net/dvls_syslog.html
Let us know if you have any feedback!
Best regards,
Richard Boisvert