HPE STOREONCE 5500

### END #######################################################################
Command Successful
Defining a new remote host to receive StoreOnce audit log
events
With StoreOnce software version 3.15.0 and later, it is possible to define a remote host to receive
StoreOnce audit log events. This is done using StoreOnce CLI logs commands. It may also be
necessary to configure the remote host to receive the log events offload.
Procedure
1. Log in to the StoreOnce CLI as an Admin user.
2. Run the following StoreOnce CLI command to add each remote host, who may be on an IPv4 or an
IPv6 network:
logs add recipient <ip> <protocol> [port]
3. Upon successful completion of the command, confirmation that the host has been added to the list of
remote syslog recipients will be displayed. For example:
# logs add recipient 192.192.1.1 UDP
# logs add recipient 192.192.10.1 tcp 5500
4. Many log programs will not require additional configuration on the target system to receive the log
offload. However, if you are using the standard syslog linux deamon (rsyslog) to receive the
logs, ,add the following to the /etc/rsyslog.conf file.
$MaxMessageSize 100k
# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514
More information
There are three StoreOnce CLI logs commands to add, delete and view log recipients. Refer to the
StoreOnce System CLI Reference Guide for more information about using them.
For log programs, other than rsyslog, refer to the software vendor for other applications for any
configuration details.
Aggregating login event notifications
The event logging component generates one event for each Login and each Logout, and two events for
each failed Login attempt. With StoreOnce software version 3.15.0 and later, there is a StoreOnce CLI
command that allows the Admin user to set a time period during which login, logout and failed login
events from a user will be aggregated. Only the first occurrence within the defined period will be logged.
Defining a new remote host to receive StoreOnce audit log events 65