Integrating Linux Server

If you are using a physical or virtual sensor, see Integrating Linux Server for a physical or virtual sensor at the bottom of this article.

To integrate Linux Server, follow the procedures below:

• Enable Linux Server

• Install the XDR collector for Linux Server

Enable Linux Server

1. In Barracuda XDR Dashboard, click Integrations .

2. On the Linux Server Collector card, click Setup.

   Open

   

3. Select the Enable check box.

   Open

   

4. Click Save.

Install the XDR Collector for Linux Server

The XDR Collector runs as a service in your environment. While the minimum specifications are listed below, the required resources depend on the number of active integrations and the amount of data being processed.

Minimum requirements

To set up the XDR Collector, the minimum requirements are the following:

Operating System

• Ubuntu 22.04 (Recommended)

• For other versions, see the Elastic Agent 8.12.x row in the Elastic Agent table on this page.

Required Endpoint/Port Communication

The XDR Collector must be able to communicate to the following endpoints/ports:

To install the XDR Collector for Linux Server

When installing the collector for Linux Server, install the collector on each Linux Server you want to monitor.

The install command is unique for each account and should only be run on systems within that account's network.

1. In Barracuda XDR Dashboard, click Infrastructure > Collectors.

2. In the Policies table, next to the on-prem policy, click Action > Install.

3. Click Linux.

   Open

   

4. Copy the command at the bottom of the dialog box.

   Open

   

5. Open a terminal o_n the server you want to monitor_, paste the command, and run it.

Integrating Linux Server for a physical or virtual sensor

By default, recent releases across most Linux distributions will have the rsyslog package already installed and enabled by default.

To send logs using syslog to the sensor please perform the following tasks as root:

1. Verify that rsyslog is installed, enabled and running.

   systemctl status rsyslog

2. Create filename /etc/rsyslog.d/sensor.conf and enter the following rule with the sensor's static IP address:

   *.notice @IP_ADDRESS

3. Restart rsyslog service.

   systemctl restart rsyslog

Troubleshooting

Service for rsyslog is installed but not enabled or running.

systemctl enable --now rsyslog

Service for rsyslog is not installed.

SUSE: yast -i rsyslog

Fedora/RHEL/CentOS: yum install rsyslog

Ubuntu/Debian: apt-get install rsyslog

Traffic for syslog is not sent to sensor from client.

1. Verify that client can ping sensor.

2. Open two terminal windows on the client.

3. In the first terminal, enter the following command to determine the primary LAN interface (e.g. eth0 ):
   ip a | grep UP

4. In the same terminal, run the following command to inspect egress traffic on the primary interface for syslog traffic:
   tcpdump -ni eth0 -Q out port 514

5. In a second terminal generate syslog traffic:
   logger "test message from log client"

6. Monitor output in the first terminal to confirm outbound syslog traffic. An abbreviated example output is indicated below:
   IP 172.29.91.84.40644 > 172.29.88.253.514: SYSLOG user.notice

7. If outbound syslog traffic if observed on client then verify that no ACLs in network are dropping traffic sent to port 514.

For Linux servers, forward your rsyslogs from your server to your Barracuda XDR sensor over UDP port 514.

Depending on your version of Linux, the configuration may vary.