Forum Discussion

RogerS's avatar
RogerS
Copper Contributor
Jan 30, 2025

Cannot stop CEF duplication to syslog when both processed by same Linux VM

We have a situation where we are sending CEF records from FortiGate firewall to Microsoft Sentinel via Common Event Format (CEF) via AMA Data connector and we also use Syslog via AMA Data connector (both on the same Ubuntu Linux VM using rsyslog) and result is that we are getting duplicates of the CEF records in the syslog.
I've read a lot of articles about the duplication and possible ways to fix however I've had not success.
My most recent attempt is to create a file /etc/rsyslog.d/05-filter-CEF.conf with the following entries:
if ($programname == "CEF") then @@127.0.0.1:28330 
& stop
Unfortunately we still get duplicates.

One article I read said to use @@127.0.0.1:25226 however then we don't get CEF records in a CommonSecurityLog or Syslog.

Is there anyone that can help?

data collection
siem
  • luchete's avatar
    luchete
    Steel Contributor
    Mar 02, 2025

    Hi RogerS,

    The issue is that the rsyslog is forwarding CEF logs to both destinations (AMA Data Connector and Syslog), causing duplication. The key is ensuring that rsyslog only forwards the logs to one destination and stops processing them after that.

    Try updating the filter to make sure it properly stops processing after forwarding the logs. You can modify the configuration like this:

    if ($programname == "CEF") then {
   action(type="omfwd" Target="127.0.0.1" Port="28330" Protocol="tcp")
   stop
}

    This ensures that the CEF records are only forwarded once to the right destination.

    Regards!

Resources