Forum Discussion

Copper Contributor

Dec 12, 2022

Issue regarding logs duplication in CEF via AMA method

Hello Everyone, Greeting!! I am configuring my linux machine and I have installed AMA agent on that machine and also run the CEF forwarder script. Link for your reference: https://learn....

siem

mikhailf

Iron Contributor

Feb 01, 2023

Hello GOYALS001 ,

You can filter out facilities from Syslog by configuring your log forwarder.

Go to Log Analytics Workspace that have Sentinel installed -> Legacy Agents Management -> Syslog. And remove facilities you don't want to be ingested into Syslog.