When you configure your VMware vCenter SSO to send log data to USM Appliance, you can use the VMware SSO plugin to translate raw log data into normalized events for analysis. The table below provides some basic information for the plugin.
| Device | Details |
|---|---|
| Vendor | VMware |
| Device Type | Network access control |
| Connection Type | Syslog |
| Data Source Name | VMware-sso |
| Data Source ID | 1894 |
Integrating VMware SSO
Before you configure the VMware vCenter SSO Server integration, you must have the IP Address of the USM Appliance Sensor.
To configure VMware vCenter SSO Server to send log data to USM Appliance
- Log in as administrator@your_domain_name to the vCenter Server instance in the vCenter Server Appliance by using the vSphere Web Client.
- On the vSphere Web Client Home page, click System Configuration.
- Under System Configuration, click Nodes and select a node from the list.
- Click the Related Objects tab.
You see a list of services running in the node you selected.
- Right-click on VMware Syslog Service and select Settings.
- Click Edit.
- From the Common Log Level drop-down menu, select *.
- In the Remote Syslog Host text box, enter the USM Appliance Sensor IP address.
- In the Remote Syslog Port text box, enter 514.
- From the Remote Syslog Protocol drop-down menu, select UDP.
- Click OK.
- From the Actions menu, click Restart, so that the configuration changes are applied.
Plugin Enablement
For plugin enablement information, see Enable Plugins.
Additional Resources and Troubleshooting
For troubleshooting, refer to the vendor documentation:
Feedback