Forum Discussion
Solved
Urgent !! CEF Syslog duplication Issue
Hi All I have configured a Fortinet integration with Azure sentinel on local7 facility. My current configuration is ingesting Fortinet logs in both the tables `CommonSecurityLog` and `syslog`. ...
- Please take a look at https://docs.microsoft.com/en-us/azure/azure-monitor/agents/agent-linux-troubleshoot#log-analytics-troubleshooting-tool and the note
https://docs.microsoft.com/en-us/azure/azure-monitor/agents/agent-linux-troubleshoot#important-configuration-files
Editing configuration files for performance counters and Syslog is overwritten if the collection is configured from the data menu Log Analytics Advanced Settings in the Azure portal for your workspace. To disable configuration for all agents, disable collection from Log Analytics Advanced Settings or for a single agent run the following: sudo /opt/microsoft/omsconfig/Scripts/OMS_MetaConfigHelper.py --disable && sudo rm /etc/opt/omi/conf/omsconfig/configuration/Current.mof* /etc/opt/omi/conf/omsconfig/configuration/Pending.mof*
I have created a new file in /etc/rsyslog.d/ called 10-filter-CEF.conf and I've tried all sorts of combinations to stop the CEF records from Fortigate firewall being duplicated into the syslog without success.
Some of the combinations I've tried are below; none of which seem to work. Help!!!
#:programname, contains, "CEF" /var/log/CEF.log
#& stop
#:hostname, contains, "prdvmfwall01" /var/log/CEF.log
#& stop
#:msg, contains, "prdvmfwall01 CEF" /var/log/CEF.log
#& stop
#:msg, contains, "0|Fortinet|Fortigate|" /var/log/CEF.log
#& stop
#:rawmsg, contains, "CEF:" /var/log/CEF.log
#& stop
#:rawmsg, contains, "CEF:" ~
#if ($rawmsg contains "CEF:") then stop
#$rawmsg contains "CEF:" then @@127.0.0.1:25226
#& stop
#:msg, contains, "CEF:" ~
if ($programname == "CEF" or $rawmsg contains "CEF:") then stop
#if ($rawmsg contains "CEF:") then stop
I'm now getting closer.
I've created a file /etc/rsyslog.d/05-filter-CEF.conf that contains the following:
if ($programname == "CEF") then @@127.0.0.1:28330
& stop
By doing this I still get CEF records in the syslog.
As suggested by some other articles I changed the port to 25226 but then don't get CEF records in syslog or CommonSecurityLog.
Please can anybody help
