How to Send Security Expert Events to a Syslog Server

[AdamSteele]

Issue

You need to forward specific events from Security Expert to a third-party Syslog server for monitoring or logging purposes.

Product Line

EcoStruxure Security Expert

Environment

• Security Expert software
• Syslog server (e.g., SolarWinds)

Cause

There is a requirement to send filtered Security Expert events (e.g., operator activity, user access, door unlocks, output activations) to an external system for analysis or integration.

Resolution

Security Expert allows you to forward events using the Send Event action. Follow these steps to configure it:

Step 1: Create an Event Filter

1. In Security Expert, go to the Events menu.
2. Create a new Event Filter that captures the specific events you want to forward.
   • Example: Filter for events like Output <PGM_NAME> On By <DOOR_NAME> Function <DOOR_FUNCTION>.
   • Tip: You can trigger these events by manually unlocking a door from the client to test the filter.event filter

Step 2: Create a Send Event Action

1. Still under the Events menu, create a new Action.
2. Set the following parameters:
   • Type: Send Event
   • Event Filter: Select the filter you created in Step 1.
   • IP Address: Enter the IP address of the Syslog server.
   • Port: Enter the port number used by the Syslog server (e.g., 514 for standard Syslog, or a custom port used by Packet Sender).action

Step 3: Test with Packet Sender

1. Use Packet Sender to simulate a Syslog server.
2. In Packet Sender:
   • Note the TCP port number shown in the bottom right corner.
   • Ensure this matches the port configured in your Security Expert Action.
   • The IP address should be the one assigned to your Security Expert server (e.g., your laptop’s IP if testing locally).
3. Manually trigger the event (e.g., unlock a door or activate a relay).status page
4. Confirm that the event is received in Packet Sender’s log window.packet sender