From d7596532d8dc135a6f258726d3f585c6eee78e63 Mon Sep 17 00:00:00 2001 From: Sebastien Quioc Date: Wed, 10 Jul 2024 09:30:56 +0200 Subject: [PATCH] fix(VMware): use placeholder to define the port --- .../collect/integrations/endpoint/vmware/vmware_vcenter.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/xdr/features/collect/integrations/endpoint/vmware/vmware_vcenter.md b/docs/xdr/features/collect/integrations/endpoint/vmware/vmware_vcenter.md index 8f90c22551..6a738ca9fb 100644 --- a/docs/xdr/features/collect/integrations/endpoint/vmware/vmware_vcenter.md +++ b/docs/xdr/features/collect/integrations/endpoint/vmware/vmware_vcenter.md @@ -38,10 +38,11 @@ with the following template: ``` $DefaultNetstreamDriverCAFile /etc/rsyslog.d/Sekoia-io-intake.pem -input(type="imtcp" port="20513" ruleset="remote20513") + +input(type="imtcp" port="PORT" ruleset="remoteVmwarevCenter") template(name="SEKOIAIOTemplate" type="string" string="<%pri%>1 %timestamp:::date-rfc3339% %hostname% %app-name% %procid% LOG [SEKOIA@53288 intake_key=\"YOUR_INTAKE_KEY\"] %msg%\n") -ruleset(name="remote20513"){ +ruleset(name="remoteVmwarevCenter"){ if($programname == "vpxd") { action( type="omfwd" @@ -59,7 +60,7 @@ ruleset(name="remote20513"){ } ``` -Please change using the YOUR_INTAKE_KEY accordingly, as well as, the input port if needed. +Please change using the YOUR_INTAKE_KEY accordingly, as well as, the PORT. Update the `docker-compose.yml` file of the Sekoia.io forwarder to mount the extended conf: