Forum Discussion

Qusai_Ismail's avatar
Qusai_Ismail
Brass Contributor
Feb 07, 2023

Duplicate logs of CEF with Syslog

Hello,

 

Is there a way to remove duplication of CommonSecurity and Syslog when Log collector Server is configured to forward CEF and Syslog.

for example F5 WAF firewall sending Syslog with CEF formate in facility Local0, which result to duplication.

We already configured the Log analytic Agent management to fetch the syslog of Local0, bcz there is different sources send with that facility. 

Is there a way to remove duplication when taken into account that we can't change it from the source system(F5 waf)

 

Thanks.

Data Collection
integration
Log Data
siem
  • omryma's avatar
    omryma
    Jun 13, 2023
    i got a solution that worked for me:
    i've created a seperate machine used only for CEF logs - on that machine just make an IPTABLES that blocks port 25224.

    sudo iptables -A INPUT -p udp --dport 25224 -j DROP
    sudo iptables -A OUTPUT -p udp --dport 25224 -j DROP

Resources