Configuring syslog for PostFix Mail Transfer Agent

To collect events, you must configure syslog on your PostFix MTA installation to forward mail events to IBM QRadar.

Procedure

  1. Use SSH to log in to your PostFix MTA installation as a root user.
  2. Edit the following file:

    /etc/syslog.conf

  3. To forward all mail events, type the following command to change -/var/log/maillog/ to an IP address. Make sure that all other lines remain intact:

    mail.*@<IP address>

    Where <IP address> is the IP address of the QRadar Console, Event Processor, or Event Collector, or all-in-one system.

  4. Save and exit the file.
  5. Restart your syslog daemon to save the changes.