Home

How to modify the syslog daemon from its default settings?

%3CLINGO-SUB%20id%3D%22lingo-sub-376778%22%20slang%3D%22en-US%22%3EHow%20to%20modify%20the%20syslog%20daemon%20from%20its%20default%20settings%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-376778%22%20slang%3D%22en-US%22%3E%3CP%3EI%20posted%20this%20on%20docuementation%20feedback%20area%20as%20well%2C%20but%20on%20the%20%3CA%20title%3D%22Connect%20your%20external%20solution%20using%20Common%20Event%20Format%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsentinel%2Fconnect-common-event-format%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3ECEF%20documentation%20page%3C%2FA%3E%20%22How%20it%20works%22%20Step%201%20mentions%3A%20%22you%20also%20modify%20them%20in%20the%20syslog%20daemon%20on%20the%20Azure%20Sentinel%20agent.%22%20around%20the%20parameters%20to%20use%20for%20appliance%20settings.%20On%20appliance%20side%20I've%20made%20the%20configurations%20I%20want%20that%20are%20non%20default.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHow%20do%20I%20modify%20the%20syslog%20daemon%3F%20I%20need%20to%20be%20able%20to%20receive%20the%20logs%20over%20TLS%20and%20port%206514%20instead%20of%20the%20default%20and%20possibly%20a%20different%20Facility.%3C%2FP%3E%3CP%3EThe%20instructions%20cover%20on%20how%20to%20configure%20the%20syslog%20agent%20which%20can%20be%20applied%20and%20used%20to%20modify%20default%20syslog%20agent%20configuration%20but%20not%20around%20syslog%20daemon.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20meantime%20I'm%20looking%20up%20generic%20Ubuntu%20or%20Linux%20instructions%20to%20see%20if%20I%20can%20apply%20them%20to%20the%20automatically%20deployed%20agent%20VM%20and%20will%20report%20back%20if%20successful.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-377725%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20modify%20the%20syslog%20daemon%20from%20its%20default%20settings%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-377725%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F222671%22%20target%3D%22_blank%22%3E%40Eliav%20Levi%3C%2FA%3E%3A%20Is%20this%20something%20you%20can%20speak%20to%3F%20%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Deleted
Not applicable

I posted this on docuementation feedback area as well, but on the CEF documentation page "How it works" Step 1 mentions: "you also modify them in the syslog daemon on the Azure Sentinel agent." around the parameters to use for appliance settings. On appliance side I've made the configurations I want that are non default.

 

How do I modify the syslog daemon? I need to be able to receive the logs over TLS and port 6514 instead of the default and possibly a different Facility.

The instructions cover on how to configure the syslog agent which can be applied and used to modify default syslog agent configuration but not around syslog daemon.

 

In meantime I'm looking up generic Ubuntu or Linux instructions to see if I can apply them to the automatically deployed agent VM and will report back if successful. 

1 Reply

@Eliav Levi: Is this something you can speak to?  

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies