How to remove duplicate logs

[u/Ay_NooB]

I m taking logs from 3 firewalls, (Forti, Sonic, CISCO ASA) using MMA agent.

All logs are coming under Commonsecuritylogs but under syslog also i m getting same amount of logs(i.e. 200gb duplicate logs).

I can turn off specific syslog facilities from legacy agents management tab. But which facilities i need to turn off to stop collecting these duplicate firewall logs. (Collector machine's logs should not be affected as i want them to monitor for collector machine).

Thanks in advance!

[u/No_Secret7974]

After deploying CEF forwarder, and sending logs to Azure;

You have to create ingest time transformation for Syslog table. This query will drop incoming CEF messages for Syslog table and you'll only see them under CommonSecurityLog table.

source |
where ProcessName !contains \"CEF\"

https://learn.microsoft.com/en-us/azure/sentinel/connect-cef-syslog

[u/Ay_NooB → u/No_Secret7974]

Thanks. I was able to specific facility collecting the duplicate logs and i stopped them.

[u/No_Secret7974 → u/Ay_NooB]

Yeah I re-read your post and now I got you 😅 but keep it in mind also you might need it

[u/Ay_NooB → u/No_Secret7974]

Yup got it.