%3CLINGO-SUB%20id%3D%22lingo-sub-2007056%22%20slang%3D%22en-US%22%3EDeep%20Dive%20How%20To%20Debug%20Syslog%20Ingestion%20for%20Sentinel%20and%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2007056%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHello%20everybody%2C%20Simone%20here%20to%20tell%20you%20about%20a%20situation%20that%20happened%20many%20times%20to%20my%20customers%3A%20understanding%20how%20the%20syslog%20ingestion%20works.%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CP%3ETo%20make%20subject%20clear%20make%20sure%20you%20have%20clear%20in%20mind%20the%20below%20references%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3ERFC5424%20-%20%3CA%20href%3D%22https%3A%2F%2Ftools.ietf.org%2Fhtml%2Frfc5424%23section-6.2.1%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3Ehttps%3A%2F%2Ftools.ietf.org%2Fhtml%2Frfc5424%23section-6.2.1%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fdata-sources-syslog%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fdata-sources-syslog%3C%2FA%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EMost%20of%20the%20time%20nobody%20knows%20what%20needs%20to%20be%20collected%20and%20how%20hence%2C%20with%20this%20article%2C%20I%20just%20want%20to%20make%20some%20clarification%20on%20what%20is%20behind%20the%20scenes.%3C%2FP%3E%0A%3CP%3EStarting%20from%20RFC%2C%20it%20is%20mentioned%20that%20we%20have%20a%20list%20of%20%E2%80%9C%3CSTRONG%3EFacility%3C%2FSTRONG%3E%E2%80%9D%20like%20in%20the%20screenshot%20below%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22sifriger_0-1608569858351.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F242120iFD85252452017034%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22sifriger_0-1608569858351.png%22%20alt%3D%22sifriger_0-1608569858351.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAnd%20for%20each%20of%20them%20we%20could%20have%20a%20specific%20%E2%80%9C%3CSTRONG%3ESeverity%3C%2FSTRONG%3E%E2%80%9D%20(see%20the%20corresponding%20picture%20below)%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22sifriger_1-1608569858358.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F242121i988FBC5AD00238A4%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22sifriger_1-1608569858358.png%22%20alt%3D%22sifriger_1-1608569858358.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EBack%20to%20the%20situation%2C%20the%20natural%20question%20that%20comes%20up%20is%3A%20how%20can%20we%20clearly%20understand%20who%20is%20using%20who%20if%20we%20have%20no%20information%20about%20facilities%20and%20severities%20about%20related%20products%20we%20are%20using%3F%3C%2FP%3E%0A%3CP%3ETo%20find%20the%20information%20we%20need%2C%20we%20must%20capture%20some%20TCP%2FUDP%20packets%20from%20the%20syslog%20server%20and%20rebuild%20the%20packets%20in%20wireshark%20and%20then%20analyze%20the%20results.%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CP%3ELet%E2%80%99s%20start%20with%20first%20step%3A%20packets%20capture.%20Below%20you%20have%20the%20macro%20steps%20to%20be%20followed%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EFrom%20the%20syslog%20server%20(in%20this%20case%20a%20Linux%20server)%20we%20will%20use%20the%20%3CSTRONG%3E%3CEM%3Etcpdump%3C%2FEM%3E%3C%2FSTRONG%3E%20command%2C%20%3CBR%20%2F%3Eif%20not%20available%20follow%20this%20link%20on%20how%20to%20setup%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fopensource.com%2Farticle%2F18%2F10%2Fintroduction-tcpdump%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3Ehttps%3A%2F%2Fopensource.com%2Farticle%2F18%2F10%2Fintroduction-tcpdump%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%3Ethe%20command%20could%20be%20for%20example%20%3CSTRONG%3E%3CEM%3E%3CBR%20%2F%3Etcpdump%20-i%20any%20-c50%20-nn%20src%20xxx.xxx.xxx.xxx%20(replace%20with%20source%20IPADDRESS%20under%20analysis)%3C%2FEM%3E%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3CLI%3Ethe%20results%20after%20the%20rebuilt%20with%20wireshark%2C%20should%20be%20something%20similar%20the%20following%20image%3A%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22sifriger_2-1608569858371.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F242122i023C43E0C1919E8D%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22sifriger_2-1608569858371.png%22%20alt%3D%22sifriger_2-1608569858371.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EThe%20header%20of%20every%20row%20contains%20exactly%20the%20information%20that%20we%20are%20looking%20for%3B%20how%20to%20deal%20with%20this%20piece%20of%20info%3F%20Easy%3B%20use%20the%20formula%20contained%20in%20the%20following%20part%20directly%20taken%20from%20RFC%3A%20%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CP%3E%E2%80%9CThe%20Priority%20value%20is%20calculated%20by%20first%20multiplying%20the%20Facility%20number%20by%208%20and%20then%20adding%20the%20numerical%20value%20of%20the%20Severity.%26nbsp%3B%20For%20example%2C%20a%20kernel%20message%20(Facility%3D0)%20with%20a%20Severity%20of%20Emergency%20(Severity%3D0)%20would%20have%20a%20Priority%20value%20of%200.%26nbsp%3B%20Also%2C%20a%20%22local%20use%204%22%20message%20(Facility%3D20)%20with%20a%20Severity%20of%20Notice%20(Severity%3D5)%20would%20have%20a%20Priority%20value%20of%20165.%26nbsp%3B%20In%20the%20PRI%20of%20a%20syslog%20message%2C%20these%20values%20would%20be%20placed%20between%20the%20angle%20brackets%20as%20%26lt%3B0%26gt%3B%20and%20%26lt%3B165%26gt%3B%20respectively.%3CBR%20%2F%3EThe%20only%20time%20a%20value%20of%20%220%22%20follows%20the%20%22%26lt%3B%22%20is%20for%20the%20Priority%20value%20of%20%220%22.%26nbsp%3B%20Otherwise%2C%20leading%20%220%22s%20MUST%20NOT%20be%20used.%E2%80%9D%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20the%20example%20above%2C%20we%20have%20the%20value%20of%20%3CSTRONG%3E%3CEM%3E%26lt%3B46%26gt%3B%3C%2FEM%3E%3C%2FSTRONG%3E.%20According%20to%20the%20above-mentioned%20RFC%2C%20the%20formula%20used%20to%20translate%20that%20number%20into%20something%20human%20readable%20is%20the%20following%3A%3C%2FP%3E%0A%3CP%3E8%20x%20facility%20%2B%20severity%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20now%20must%20look%20for%20the%20formula%20result%20in%20the%20following%20matrix%3A%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CTABLE%20width%3D%22619%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%3E%3CP%3EEmergency%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%3E%3CP%3EAlert%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%3E%3CP%3ECritical%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%3E%3CP%3EError%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%3E%3CP%3EWarning%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%3E%3CP%3ENotice%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%3E%3CP%3EInformational%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%3E%3CP%3EDebug%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%3E%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%3E%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3EKernel%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E0%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E1%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E2%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E3%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E4%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E5%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E6%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E7%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Euser-level%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E8%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E9%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E10%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E11%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E12%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E13%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E14%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E15%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Email%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E16%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E17%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E18%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E19%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E20%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E21%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E22%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E23%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Esystem%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E24%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E25%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E26%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E27%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E28%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E29%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E30%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E31%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Esecurity%2Fauth%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E32%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E33%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E34%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E35%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E36%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E37%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E38%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E39%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Emessage%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E40%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E41%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E42%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E43%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E44%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E45%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E46%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E47%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Eprinter%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E48%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E49%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E50%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E51%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E52%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E53%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E54%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E55%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Enetwork%20news%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E56%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E57%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E58%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E59%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E60%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E61%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E62%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E63%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3EUUCP%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E64%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E65%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E66%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E67%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E68%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E69%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E70%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E71%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Eclock%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E72%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E73%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E74%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E75%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E76%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E77%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E78%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E79%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Esecurity%2Fauth%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E80%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E81%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E82%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E83%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E84%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E85%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E86%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E87%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3EFTP%20deamon%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E88%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E89%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E90%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E91%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E92%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E93%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E94%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E95%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3ENTP%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E96%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E97%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E98%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E99%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E100%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E101%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E102%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E103%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3ELog%20Audit%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E104%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E105%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E106%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E107%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E108%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E109%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E110%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E111%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3ELog%20Alert%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E112%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E113%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E114%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E115%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E116%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E117%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E118%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E119%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3EClock%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E120%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E121%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E122%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E123%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E124%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E125%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E126%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E127%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Elocal0%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E128%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E129%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E130%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E131%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E132%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E133%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E134%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E135%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Elocal1%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E136%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E137%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E138%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E139%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E140%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E141%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E142%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E143%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Elocal2%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E144%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E145%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E146%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E147%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E148%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E149%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E150%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E151%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Elocal3%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E152%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E153%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E154%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E155%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E156%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E157%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E158%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E159%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Elocal4%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E160%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E161%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E162%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E163%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E164%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E165%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E166%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E167%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Elocal5%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E168%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E169%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E170%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E171%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E172%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E173%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E174%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E175%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Elocal6%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E176%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E177%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E178%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E179%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E180%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E181%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E182%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E183%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2289%22%3E%3CP%3Elocal7%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2275%22%20class%3D%22lia-align-center%22%3E%3CP%3E184%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E185%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E186%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E187%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E188%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2260%22%20class%3D%22lia-align-center%22%3E%3CP%3E189%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2291%22%20class%3D%22lia-align-center%22%3E%3CP%3E190%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2265%22%20class%3D%22lia-align-center%22%3E%3CP%3E191%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESo%20now%2C%20let%E2%80%99s%20make%20one%20step%20back%20to%20customer%E2%80%99%20question%20and%20%E2%80%9Cguess%E2%80%9D%20what%20the%20%E2%80%9C%3CSTRONG%3EFacility%3C%2FSTRONG%3E%E2%80%9D%20and%20the%20%E2%80%9C%3CSTRONG%3ESeverity%3C%2FSTRONG%3E%E2%80%9D%20are%20in%20the%20provided%20example.%3C%2FP%3E%0A%3CP%3ESince%20header%20was%20%3CSTRONG%3E%3CEM%3E46%3C%2FEM%3E%3C%2FSTRONG%3E%2C%20the%20result%20was%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EFacility%20%3D%20%3CSTRONG%3Emessage%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3CLI%3ESeverity%20%3D%20%3CSTRONG%3EInformational%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EOnce%20we%20understood%20what%20to%20deal%20with%2C%20it's%20time%20to%20configure%20Log%20Analytics%20%2F%20Sentinel%20enabling%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fdata-sources-syslog%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3ESyslog%20data%20sources%20in%20Azure%20Monitor%3C%2FA%3E.%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CP%3EAll%20we%20have%20to%20do%20is%20to%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3Eadd%20the%20facilities%20(by%20entering%20its%20name%20and%20leveraging%20the%20intellisense)%20to%20the%20workspace.%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22sifriger_3-1608569858377.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F242124i412ED3CBA256A911%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22sifriger_3-1608569858377.png%22%20alt%3D%22sifriger_3-1608569858377.png%22%20%2F%3E%3C%2FSPAN%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3C%2FLI%3E%0A%3CLI%3Eselect%20what%20severity(ies)%20to%20import.%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22sifriger_4-1608569858407.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F242125i8618A77DCA5D1E79%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22sifriger_4-1608569858407.png%22%20alt%3D%22sifriger_4-1608569858407.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%26nbsp%3Band%20click%20Save.%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22sifriger_5-1608569858411.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F242123i1D868399358813BE%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22sifriger_5-1608569858411.png%22%20alt%3D%22sifriger_5-1608569858411.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EUsing%20some%20real-life%20example%2C%20if%20we%20want%20to%20collect%20the%20logs%20for%20FTP%2C%20the%20corresponding%20facility%20to%20be%20entered%20is%20%E2%80%9C%3CSTRONG%3Eftp%3C%2FSTRONG%3E%E2%80%9D%20and%20the%20following%20logs%20will%20be%20imported%3A%3C%2FP%3E%0A%3CTABLE%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22236%22%3E%3CP%3E%3CSTRONG%3ESyslog%20file%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20colspan%3D%222%22%20width%3D%22217%22%3E%3CP%3E%3CSTRONG%3ELog%20Path%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22236%22%3E%3CP%3E%3CSTRONG%3Eftp.info%3B%20ftp.notice%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20colspan%3D%222%22%20width%3D%22217%22%3E%3CP%3E%2Flog%2Fftplog%2Fftplog.info%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22236%22%3E%3CP%3E%3CSTRONG%3Eftp.warning%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22217%22%3E%3CP%3E%2Flog%2Fftplog%2Fftplog.warning%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22236%22%3E%3CP%3E%3CSTRONG%3Eftp.debug%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20colspan%3D%222%22%20width%3D%22217%22%3E%3CP%3E%2Flog%2Fftplog%2Fftplog.debug%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22236%22%3E%3CP%3E%3CSTRONG%3Eftp.err%3B%20ftp.crit%3B%20ftp.emerg%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22217%22%3E%3CP%3E%2Flog%2Fftplog%2Fftplog.err%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EDifferently%2C%20talking%20about%20Users%2C%20the%20facility%20is%20%E2%80%9C%3CSTRONG%3Euser%3C%2FSTRONG%3E%E2%80%9D%20and%20the%20imported%20logs%20will%20be%3A%3C%2FP%3E%0A%3CTABLE%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22236%22%3E%3CP%3E%3CSTRONG%3ESyslog%20file%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20colspan%3D%222%22%20width%3D%22217%22%3E%3CP%3E%3CSTRONG%3ELog%20Path%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22236%22%3E%3CP%3E%3CSTRONG%3Euser.info%3Buser.notice%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20colspan%3D%222%22%20width%3D%22217%22%3E%3CP%3E%2Flog%2Fuser%2Fuser.info%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22236%22%3E%3CP%3E%3CSTRONG%3Euser.warning%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22217%22%3E%3CP%3E%2Flog%2Fuser%2Fuser.warning%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22236%22%3E%3CP%3E%3CSTRONG%3Euser.debug%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20colspan%3D%222%22%20width%3D%22217%22%3E%3CP%3E%2Flog%2Fuser%2Fuser.debug%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22236%22%3E%3CP%3E%3CSTRONG%3Euser.err%3Buser.crit%3Buser.emerg%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22217%22%3E%3CP%3E%2Flog%2Fuser%2Fuser.err%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAnother%20one%3A%20for%20Apache%2C%20the%20facility%20is%20%E2%80%9C%3CSTRONG%3Elocal0%3C%2FSTRONG%3E%E2%80%9D%20and%20the%20logs%20will%20be%3A%3C%2FP%3E%0A%3CTABLE%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22236%22%3E%3CP%3E%3CSTRONG%3ESyslog%20file%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20colspan%3D%222%22%20width%3D%22217%22%3E%3CP%3E%3CSTRONG%3ELog%20Path%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22236%22%3E%3CP%3E%3CSTRONG%3Elocal0.info%3Blocal0.notice%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20colspan%3D%222%22%20width%3D%22217%22%3E%3CP%3E%2Flog%2Fhttpd%2Fhttpd.%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22236%22%3E%3CP%3E%3CSTRONG%3Elocal0.warning%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22217%22%3E%3CP%3E%2Flog%2Fhttpd%2Fhttpd.warning%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22236%22%3E%3CP%3E%3CSTRONG%3Elocal0.debug%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20colspan%3D%222%22%20width%3D%22217%22%3E%3CP%3E%2Flog%2Fhttpd%2Fhttpd.debug%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22236%22%3E%3CP%3E%3CSTRONG%3Elocal0.err%3B%20local0.crit%3Blocal0.emerg%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%22217%22%3E%3CP%3E%2Flog%2Fhttpd%2Fhttpd.err%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20have%20everything%20in%20place%2C%20but%20are%20we%20really%20sure%20that%20info%20is%20produced%3F%20%3CBR%20%2F%3EWhat%20if%20you%20would%20like%20to%20effectively%20test%20that%20data%20is%20flowing%20in%20the%20corresponding%20facility%3F%20%3CBR%20%2F%3EWe%20can%20leverage%20the%20following%20sample%20commands%20for%20CEF%20%26amp%3B%20Syslog%20using%20the%20%3CSTRONG%3E%3CEM%3Elogger%3C%2FEM%3E%3C%2FSTRONG%3E%20built-in%20utility%3A%3C%2FP%3E%0A%3CP%3E%3CEM%3E%3CBR%20%2F%3Elogger%20-p%20auth.notice%20%22Some%20message%20for%20the%20auth.log%20file%22%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3Elogger%20-p%20%3C%2FEM%3Elocal0.info%3CEM%3E%20%22Some%20message%20for%20the%20local0.log%20file%22%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3Elogger%20%22CEF%3A0%7CMicrosoft%7CMOCK%7C1.9.0.0%7CSuspiciousActivity%7CDemo%20suspicious%20activity%7C5%7C%3CFONT%20color%3D%22%23FF0000%22%3Estart%3D2020-12-12T18%3A52%3A58.0000000Z%3C%2FFONT%3E%20app%3Dmock%20suser%3Dsimo%20msg%3DDemo%20suspicious%20activity%20externalId%3D2024%20cs1Label%3Dtag%20cs1%3Dmy%20test%22%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3ENote%20pay%20attention%20to%20time%20when%20you%20query%20for%20this%20result!!!%26nbsp%3B%3B)%3C%2Fimg%3E%3C%2FP%3E%0A%3CP%3EThat%E2%80%99s%20it%20from%20my%20side%2C%20thank%20you%20for%20reading%20my%20article%20till%20the%20end.%3C%2FP%3E%0A%3CP%3ESpecial%20thanks%20go%20to%26nbsp%3BBruno%20Gabrielli%20for%20review%3C%2FP%3E%0A%3CP%3ESimone%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-2007056%22%20slang%3D%22en-US%22%3E%3CP%3EMost%20of%20the%20time%20nobody%20knows%20what%20needs%20to%20be%20collected%20and%20how%20hence%2C%20with%20this%20article%2C%20I%20just%20want%20to%20make%20some%20clarification%20on%20what%20is%20behind%20the%20scenes.%3C%2FP%3E%0A%3CP%3EStarting%20from%20RFC%2C%20it%20is%20mentioned%20that%20we%20have%20a%20list%20of%20%E2%80%9C%3CSTRONG%3EFacility%3C%2FSTRONG%3E%E2%80%9D%20like%20in%20the%20screenshot%20below%3A%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22RFC-facility.png%22%20style%3D%22width%3A%20477px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F242118iAF734582BF0F2A4F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22RFC-facility.png%22%20alt%3D%22RFC-facility.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2007056%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ESimoneFrigerio%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Microsoft

 

Hello everybody, Simone here to tell you about a situation that happened many times to my customers: understanding how the syslog ingestion works.

To make subject clear make sure you have clear in mind the below references:

Most of the time nobody knows what needs to be collected and how hence, with this article, I just want to make some clarification on what is behind the scenes.

Starting from RFC, it is mentioned that we have a list of “Facility” like in the screenshot below:

sifriger_0-1608569858351.png

 

And for each of them we could have a specific “Severity” (see the corresponding picture below):

sifriger_1-1608569858358.png

 

Back to the situation, the natural question that comes up is: how can we clearly understand who is using who if we have no information about facilities and severities about related products we are using?

To find the information we need, we must capture some TCP/UDP packets from the syslog server and rebuild the packets in wireshark and then analyze the results.

Let’s start with first step: packets capture. Below you have the macro steps to be followed:

  • From the syslog server (in this case a Linux server) we will use the tcpdump command,
    if not available follow this link on how to setup
    https://opensource.com/article/18/10/introduction-tcpdump
  • the command could be for example
    tcpdump -i any -c50 -nn src xxx.xxx.xxx.xxx (replace with source IPADDRESS under analysis)
  • the results after the rebuilt with wireshark, should be something similar the following image:sifriger_2-1608569858371.png

The header of every row contains exactly the information that we are looking for; how to deal with this piece of info? Easy; use the formula contained in the following part directly taken from RFC:

“The Priority value is calculated by first multiplying the Facility number by 8 and then adding the numerical value of the Severity.  For example, a kernel message (Facility=0) with a Severity of Emergency (Severity=0) would have a Priority value of 0.  Also, a "local use 4" message (Facility=20) with a Severity of Notice (Severity=5) would have a Priority value of 165.  In the PRI of a syslog message, these values would be placed between the angle brackets as <0> and <165> respectively.
The only time a value of "0" follows the "<" is for the Priority value of "0".  Otherwise, leading "0"s MUST NOT be used.”

 

In the example above, we have the value of <46>. According to the above-mentioned RFC, the formula used to translate that number into something human readable is the following:

8 x facility + severity

 

We now must look for the formula result in the following matrix:

 

Emergency

Alert

Critical

Error

Warning

Notice

Informational

Debug

                 

Kernel

0

1

2

3

4

5

6

7

user-level

8

9

10

11

12

13

14

15

mail

16

17

18

19

20

21

22

23

system

24

25

26

27

28

29

30

31

security/auth

32

33

34

35

36

37

38

39

message

40

41

42

43

44

45

46

47

printer

48

49

50

51

52

53

54

55

network news

56

57

58

59

60

61

62

63

UUCP

64

65

66

67

68

69

70

71

clock

72

73

74

75

76

77

78

79

security/auth

80

81

82

83

84

85

86

87

FTP deamon

88

89

90

91

92

93

94

95

NTP

96

97

98

99

100

101

102

103

Log Audit

104

105

106

107

108

109

110

111

Log Alert

112

113

114

115

116

117

118

119

Clock

120

121

122

123

124

125

126

127

local0

128

129

130

131

132

133

134

135

local1

136

137

138

139

140

141

142

143

local2

144

145

146

147

148

149

150

151

local3

152

153

154

155

156

157

158

159

local4

160

161

162

163

164

165

166

167

local5

168

169

170

171

172

173

174

175

local6

176

177

178

179

180

181

182

183

local7

184

185

186

187

188

189

190

191

 

So now, let’s make one step back to customer’ question and “guess” what the “Facility” and the “Severity” are in the provided example.

Since header was 46, the result was:

  • Facility = message
  • Severity = Informational

Once we understood what to deal with, it's time to configure Log Analytics / Sentinel enabling the Syslog data sources in Azure Monitor.

All we have to do is to:

  • add the facilities (by entering its name and leveraging the intellisense) to the workspace.
    sifriger_3-1608569858377.png

     

  • select what severity(ies) to import.
    sifriger_4-1608569858407.png

 

  •  and click Save.
    sifriger_5-1608569858411.png

 

Using some real-life example, if we want to collect the logs for FTP, the corresponding facility to be entered is “ftp” and the following logs will be imported:

Syslog file

Log Path

ftp.info; ftp.notice

/log/ftplog/ftplog.info

ftp.warning

/log/ftplog/ftplog.warning

ftp.debug

/log/ftplog/ftplog.debug

ftp.err; ftp.crit; ftp.emerg

/log/ftplog/ftplog.err

 

Differently, talking about Users, the facility is “user” and the imported logs will be:

Syslog file

Log Path

user.info;user.notice

/log/user/user.info

user.warning

/log/user/user.warning

user.debug

/log/user/user.debug

user.err;user.crit;user.emerg

/log/user/user.err

 

Another one: for Apache, the facility is “local0” and the logs will be:

Syslog file

Log Path

local0.info;local0.notice

/log/httpd/httpd.

local0.warning

/log/httpd/httpd.warning

local0.debug

/log/httpd/httpd.debug

local0.err; local0.crit;local0.emerg

/log/httpd/httpd.err

 

We have everything in place, but are we really sure that info is produced?
What if you would like to effectively test that data is flowing in the corresponding facility?
We can leverage the following sample commands for CEF & Syslog using the logger built-in utility:


logger -p auth.notice "Some message for the auth.log file"

logger -p local0.info "Some message for the local0.log file"

logger "CEF:0|Microsoft|MOCK|1.9.0.0|SuspiciousActivity|Demo suspicious activity|5|start=2020-12-12T18:52:58.0000000Z app=mock suser=simo msg=Demo suspicious activity externalId=2024 cs1Label=tag cs1=my test"


Note pay attention to time when you query for this result!!! ;)

That’s it from my side, thank you for reading my article till the end.

Special thanks go to Bruno Gabrielli for review

Simone