Configure ArcSight Logger Policies

1. Open the Policy Templates manager:

   Administration > Monitoring > Policy Templates

   Alternatively, click Policy Templates.

2. In the Policy Template Groups pane, expand Policy Management > Templates grouped by type > Configuration.

3. Click the ArcSight Logger folder, and then do one of the following:

   • To add a new policy template, in the Policy Templates pane, click the  New Item button, and then click the Add New Policy Template... or the Add New Policy Template (Raw Mode) button.

     The New ArcSight Logger Template Editor opens.

   • To edit an existing policy template, click the policy template in the Policy Templates pane, click the  Edit Item button, and then click the Edit Policy Template or the Edit Policy Template (Raw Mode) button.

     The Edit ArcSight Logger Template Editor opens.

ArcSight Logger policies configure ArcSight Logger receivers on the system to which they are deployed. The policies must use the following syntax:

• Receiver name, type, and state syntax

  The policy template name determines the name of the receiver in ArcSight Logger. The policy parameters _logger_receiver_type and _logger_receiver_state define the receiver type and state.

  For example, the policy "Audit Log", which contains the policy parameter _logger_receiver_type with the value localfile and the parameter _logger_receiver_state with the value true creates a receiver named "Audit Log" of the type "File Receiver" that is enabled in ArcSight Logger after deployment.

  If the policy template does not contain the parameters _logger_receiver_type and _logger_receiver_state, the policy template by default creates a receiver of the type File Receiver. The state of the receiver in ArcSight Logger depends on the state of the deployed policy (that is, enabled or disabled). If the parameters exist in the policy template but have empty values, a receiver of the type File Receiver will be created in ArcSight Logger but will be disabled by default.

  Parameter Name	Parameter Type	Parameter Value
  _logger_receiver_type	Enumeration	Defines the receiver type. Supported values are: udp Creates a receiver for UDP messages (for example, SYSLOG). tcp Creates a receiver for TCP messages (for example, SYSLOG, which can also be sent with TCP). localfile Creates a receiver to read logs from a local or remote file system (for example, NFS, CIFS, or SAN). filetransfer Creates a receiver to read remote logs using scp, sftp or ftp. smartmsg Creates a receiver for encrypted SmartMessage messages sent by SmartConnectors. cefudp Creates a receiver for CEF (Common Event Format) messages sent through UDP. ceftcp Creates a receiver for CEF (Common Event Format) messages sent through TCP.
  _logger_receiver_state	String	Defines the receiver state. Supported values are: true Sets the receiver state to enabled in ArcSight Logger. false Sets the receiver state to disabled in ArcSight Logger.

• Receiver parameter syntax

  The data part of an ArcSight Logger policy template defines the details of a receiver. Each receiver property is defined by a receiver parameter name-value pair. You can optionally create policy parameters for each receiver parameter and insert them as variables in place of the values.

  For more information about the receiver parameters, see the ArcSight Logger Help.

  Tip You can add as many different parameter name-value pairs to your ArcSight Logger policy template as you want. ArcSight Logger ignores parameters that are not relevant to the receiver configured by the policy template.

  UDP, TCP, CEF UDP, and CEF TCP Receiver parameters

  Parameter Name	Receiver Property
  ip	IP/Host
  PORT	Port
  Encoding	Encoding

  File Receiver parameters

  Parameter Name	Receiver Property
  rfsname	RFS Names
  folder	Folder
  sourcetype	Source Type
  wildcard	Wildcard (regex)
  mode	Mode
  renameext	Rename extension
  charencoding	Character encoding
  delayafterfirstseen	Delay after seen
  datetimelocale	Date/time locale
  datetimezone	Date/time zone
  datetimelocregex	Date/time loc regex
  datetimeformat	Date/time format
  singlelinestart	Event start (regex)

  File Transfer Receiver parameters

  Parameter Name	Receiver Property
  protocol	Protocol
  port	Port
  host	Ip/Host
  username	User
  password	Password
  filepath	File path
  schedule	Schedule
  zipformat	Zip Format
  sourcetype	Source Type
  charencoding	Character encoding
  delayafterfirstseen	Delay after seen
  datetimelocale	Date/time locale
  datetimezone	Date/time zone
  datetimelocregex	Date/time loc regex
  datetimeformat	Date/time format
  singlelinestart	Event start (regex)

  Smart Message Receiver parameters

  Parameter Name	Receiver Property
  Encoding	Encoding

The following policy data creates an enabled ArcSight Logger receiver of the type "File Receiver". The receiver reads all files in the folder /home/arcsight/filereceiver01 on the ArcSight Logger system.

<?xml version="1.0" encoding="UTF-8"?>
<ParameterValues>
   <Parameter Name="_logger_receiver_type" Value="localfile"/>
   <Parameter Name="_logger_receiver_state" Value="true/>
   <Parameter Name="rfsname" Value="LOCAL"/>
   <Parameter Name="folder" Value="/home/arcsight/filereceiver01"/>
   <Parameter Name="sourcetype" Value="Other"/>
   <Parameter Name="wildcard" Value=".*"/>
   <Parameter Name="mode" Value="persist"/>
   <Parameter Name="renameext" Value=".done"/>
   <Parameter Name="charencoding" Value="US-ASCII"/>
   <Parameter Name="delayafterfirstseen" Value="10"/>
   <Parameter Name="datetimelocale" Value="en_US"/>
   <Parameter Name="datetimezone" Value="Europe/Berlin"/>
   <Parameter Name="datetimelocregex" Value=""/>
   <Parameter Name="datetimeformat" Value=""/>
   <Parameter Name="singlelinestart" Value=""/>
</ParameterValues>

You assign ArcSight Logger policy templates to the remote systems from which you want to receive data in ArcSight Logger. Based on the connected server configuration, OMi then selects an ArcSight Logger server and deploys the policy template to that server. The ArcSight Logger server finally creates the corresponding receivers and starts receiving data from the corresponding hosts.

To be able to assign and deploy an ArcSight Logger policy template, the ArcSight Logger system must be set up as a connected server in OMi and a node CI must exist for the system in Monitored Nodes. In addition, the remote systems that send data to ArcSight Logger must be represented as node CIs in the RTSM.

If the ArcSight Logger policy template contains parameters, you can choose to deploy the policy template with the default values or provide custom values during the assignment or tuning. For example, even if the default value of the _logger_receiver_type parameter is localfile, you can tune this parameter before deployment and change it to udp.

Before you can collect log data from a node using ArcSight Logger, you must complete the following steps:

• Install HPE Operations Agent and the HPE Operations Subagent for ArcSight Logger on the ArcSight Logger system. For details, see How to Install the HPE Operations Subagent for ArcSight Logger.

• Set up the ArcSight Logger system as a connected server in OMi.

  For details, see Connected Servers.

• Verify that a node CI has been created for the ArcSight Logger system and also make sure the systems that send data to ArcSight Logger are represented as node CIs in the RTSM, access:

  Administration > Setup and Maintenance > Monitored Nodes

  Alternatively, click Monitored Nodes.

1. Prerequisite: Make sure HPE Operations Agent is installed on the ArcSight Logger system.

2. On the OMi Data Processing Server, navigate to the subagent installation files:

   <OMi_HOME>/opr/subagents/arcsight_logger

3. Copy the subagent installation files from the OMi Data Processing Server to a temporary directory on the ArcSight Logger system.

4. On the ArcSight Logger system, execute the installation script install_asloggersubagent.sh.

   The script prompts you for the installation directory on the ArcSight Logger system. Type /opt/arcsight/, for example.

1. In the ArcSight Logger Policy Editor, in the Properties page, type a Name for the policy.

   Optional. Provide a description of the policy (Description), select the instrumentation that will be deployed with the policy onto the host system where the agent is running (Instrumentation), and select the operating systems with which the policy is compatible (OS Types).

   For more information, see Properties Page.

2. Use the Policy Parameters tab to create the _logger_receiver_state and the _logger_receiver_type parameters.

   For more details, see Receiver name, type, and state syntax and Policy Parameters Tab.

3. In the Policy Data page, type the details of the receiver using name-value pairs. If you are creating a new policy, copy and paste template data from an existing policy template. Alternatively, click the button to load policy data from a policy template file on your computer.

   For details, see Receiver parameter syntax.

4. Click Save and Close to save the policy template and exit the wizard.

5. Optional. If the receiver state has been set to false (disabled), enable the receiver in ArcSight Logger (Configuration > Event Input/Output) after the deployment.