Syslog TLS and Server Setting in ESKM

1. Click the Device tab and click the Log Configuration link under the Logs & Statistics section.

2. Click the Edit button under the Syslog Settings table.

3. Select the checkboxes under the Enable Syslog column for the logs that need to be displayed in Elasticsearch.

4. Enter the machine IP where Elasticsearch / Elastic Stack is installed in the Syslog Server #1 IP column and enter port number 6514 in the Syslog Server #1 Port column.

5. Click the Save button.

Syslog Settings

6. Click the Edit button in the Syslog TLS Settings section.

7. Enable the Enable TLS checkbox.

8. Select the uploaded client certificate name from the Certificate dropdown list.

9. Select the uploaded CA from the Trusted Certificate Authority dropdown list.

10. Click the Save button.

Syslog TLS Settings

11. Click on the Syslog Test button in the Syslog Settings section.

Syslog server connection confirmation message

12. Log out from the ESKM Web UI and log in again.

13. Click the Device tab and click the Log Viewer link under the Logs & Statistics section.

14. Click on the Audit link under the Log Viewer section and note down the latest logs displayed under Log File: Current.

Audit log details