Текст страницы
Managing the Machine
Sending Logs
C0JS-06F
You can send logs to an SIEM (Security Information and Event Management) system to confirm and analyze how the
machine is used.
For the details of the logs that are sent, see the specifications of the logs.
Log Type(P. 31)
Using SIEM to Analyze the Audit Logs of Canon Printers/Multifunction Printers
Configure these settings using Remote UI from a computer. You cannot use the control panel to configure the
settings.
Administrator privileges are required.
1 Log in to Remote UI in Administrator Mode. Starting Remote UI(P. 264)
2 On the Portal page of Remote UI, click [Settings/Registration]. Portal Page of
Remote UI(P. 267)
[Syslog Settings]
[Edit].
3 Click [Device Management]
➠The [Edit Syslog Settings] screen is displayed.
4 Select the [Use Syslog Send] checkbox.
5 Enter the address of the Syslog server that is connected in [Syslog Server Address].
●Enter the necessary information, such as IP address and host name, according to your environment.
6 Specify other settings to access the Syslog server, if necessary.
[Syslog Server Port Number]
Enter the port number used by the Syslog server for Syslog communication. If left blank, the port number
defined in RFC (UDP: 514, TCP: 1468, TCP (TLS): 6514) is used.
[Facility]
Specify the type of log messages to send. Select one of the following: [Local0] to [Local7], [Log Alert], [Log
Audit], [Security Messages], or [LPR] defined in RFC.
[Connection Type]
Select [UDP] or [TCP]. When [TCP] is selected, you can specify whether to use TCP, verify the TLS server
certificate sent during the connection, or check the CN (Common Name) of the TLS server.
7 Click [OK].
➠Log sending settings are set and you can confirm the sending logs on the [Syslog Settings] screen.
●Since a log is sent via the Syslog protocol after polling every 30 seconds, a slight time lag occurs before the
log is sent when an operation or event takes place.
276