Up
Previous Next

Sheriff CSM™

Cisco RV

When you configure Cisco RV Series VPN Router to send log data to Sheriff CSM, you can use the Cisco-rv plugin to translate raw log data into normalized events for analysis. The table below provides some basic information for the plugin:

Plugin Information

Device	Details
Vendor	Cisco
Device Type	Router/Switch
Connection Type	Syslog
Data Source Name	cisco-rv
Data Source ID	1868

Integrating the Cisco RV Series VPN Router

Before you configure the Cisco RV Series VPN Router integration, you must have the IP Address of the Sheriff CSM Sensor (Deputy).

To configure Cisco RV to send log data to Sheriff CSM

1. Log in to the web configuration utility and choose Log > System Log.

2. Check the Enable Syslog check box to enable the syslog service on the device.

3. Enter the IP address of Sheriff CSM in the Syslog server field.

   

4. Click Save to save the configuration.

Note: In the Log Setting section of the web configuration utility, you can also specify those system messages you want to collect and send to Sheriff CSM. For more information on log message settings, see

https://sbkb.cisco.com/CiscoSB/GetArticle.aspx?docid=ad8b081c5c184d539f1e6acba21e9ac2_Syslog_Configuration_on_RV042.xml&pid=2.

After enabling Syslog, you may want to monitor the volume of messages that you are receiving from any particular device, because storage space can become an issue. You can also determine whether collecting any specific message types contributes significantly to your security monitoring efforts, or is just creating a lot of "noise".

Plugin Enablement

For plugin enablement information, see Enable Plugins.

Additional Resources and Troubleshooting

https://sbkb.cisco.com/CiscoSB/GetArticle.aspx?docid=ad8b081c5c184d539f1e6acba21e9ac2_Syslog_Configuration_on_RV042.xml&pid=2

For troubleshooting, refer to the vendor documentation:

https://www.cisco.com/c/en/us/support/routers/small-business-rv-series-routers/tsd-products-support-series-home.html