Our Customer has a requirement to send all logs from the MSL servers to a product called SIEM by McAfee. Its a remote syslog server product.

We've tried to add a remote syslog server using the MSL's GUI but not all of the logs are sent, barely any. If we manually edit the rsyslog file in linux and add . 10.20.20.1 then a lot more logs are sent. The customer says McAfee Technical support says for Linux machines they need . plus their SYSLOG IP. However, this is one of the files that Mitel Standard Linux overwrites so the * . * is reset back to syslog.

We'd like the addition of the * . * entry to the facility tab in the SYSLOG settings.

Thanks.