KB No. 2809: Sending browsing logs to Splunk Enterprise SIEM

This article provides step-by-step instructions on how to connect your Olfeo OP to your Splunk Enterprise 9.1.1 SIEM in order to send your browsing logs to it.

Prerequisites

Outbound port 514 must be open for Olfeo to connect to the Splunk Enterprise server, and the server must accept requests on port 514.

To accept requests on port 514 on a Splunk Enterprise server running CentOS, you can use the following command:

sudo firewall-cmd --add-port=514/tcp --zone=public --permanent && sudo firewall --reload

Steps

• To redirect logs to a file dedicated to Olfeo, open your rsyslog configuration file /etc/rsyslog.conf and add the following line in the #### RULES #### section (you can modify the file to which it should send the logs):

if $programname == 'olfeo' then /var/log/olfeo.log

• Restart the Rsyslog daemon with the following command:

systemctl restart rsyslog

• Then assign ownership of the/var/log/olfeo.log file to the splunk user and the splunk group:

chown splunk:splunk /var/log/olfeo.log

• In the administration interface of your Olfeo master, go toSettings > Supervision > Syslog,then Add a syslog server. You can then fill in theLabel and Server (IPv4 or FQDN) fieldsand check the Send traffic logs box.