Accenture MDR Quick Start Guide for Internet Systems Consortium (ISC) - Dynamic Host Configuration Protocol (DHCP)

This quick start guide will help Accenture MDR customers configure Internet Systems Consortium (ISC) - Dynamic Host Configuration Protocol (DHCP) to send logs to the Log Collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in

Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table1-1: Port requirements for LCP communication.

Configuring ISC DHCP

1. To check the DHCP logging facility, follow the steps below.

a. Open the dhcpd.conf file (located in the /etc/dhcp directory) in the preferred file editor (for example, vi).

b. Look for the log-facility statement in the file. It will look like: log-facility local6;

c. Note down the facility (the string afterlog-facility, for example, local6 in the above case) and close the file.

2. To editing the rsyslog.conf file:

a. Open the /etc/rsyslog file (or /etc/syslog file in older Linux and Solaris distributions) in the preferred file editor (for example, vi editor).

b. For ISC DHCP installed on a Linux machine:

• Add the following lines at the end of the ### RULES ###### section: 

  • To forward logs over UDP protocol: <logfacility>.* @<ip_address_of_collector_machine>:<port used by collector>

  • To forward logs over TCP protocol: <logfacility>.*@@<ip_address_or_hostname_of_collector_machine>:<port used by collector>where logfaciltiy => facility noted in step 3 from the above section.A sample entry will look like local6.*@mylcp:11514 assuming that the collector is listening on port 11514.

• Save and close the file.

• Restart the rsyslog service by executing following command: service rsyslog restart

c. For ISC DHCP installed on Solaris machine:

• Add the following lines at the end of the file:

  • To forward logs over UDP protocol: <logfacility>.info @<ip_address_of_collector_machine>:<port used by collector><logfacility>.err@<ip_address_of_collector_machine>:<port used by collector>

  • To forward logs over TCP protocol:  <logfacility>.info @@<ip_address_of_collector_machine>:<port used by collector><logfacility>.err @@<ip_address_of_collector_machine>:<port used by collector> where Logfaciltiy => facility noted in the step 3 from the above section. 

• Save and close the file.

• Restart rsyslog service by executing following command: svcadm restart system-log

​LCP Configuration Properties

Table 1-2: The ISC DHCP event collector(Syslog-3324) properties to be configured by MSS are shown in the table.