How to send VISULOX Events to external services

Overview

VISULOX Events are generated in several parts of the software. All events are stored in the database.

Every event is also seen in the event script and can be delivered to external systems.

The script is placed in $VLXDIR/tools/event.sh. The results are ignored. The file permissions must be vlx/vlxgroup/0550.

This can be used for external systems like Syslog or SIEM integration (SIEM: Security Information and Event Management).

The use case on this is the syslog integration. Sending information to a syslog server.

Send all events to syslog

CODE

#!/bin/bash
subject="$VLXEVENT $VLXOWNER $VLXAPPLICATION $VLXAPPLICATIONHOST $VLXEVENTINFO"
tag="VISULOX"
logger -t $tag -p user.err "$subject"

The event information is seen in the script as shell environment information. Depending of the event type different information is provided.

The script $VLXDIR/tools/event.sh has to be adjusted.

This script is not replicated to other VISULOX Nodes.

Only those events are seen in that script which are generated on that node.