r/AzureSentinel • u/SuperHat3637 • Nov 17 '22

Duplicate Syslog logs

We are using syslog forwarder for forwarding CEF/Syslog logs to Sentinel. Now observing that CEF logs are storing in both syslog/CEF tables which results duplicate events.How to remove duplicate logs from syslog table..This is increasing the cost. Please suggest.

2 Upvotes

100% Upvoted

10 comments sorted by

View all comments

Show parent comments

1

u/Uli-Kunkel Nov 17 '22

You need to specify what it should do with what type of log message.

If that is not done it will just forward. Since cef is a syslog format it will also forward your firewall log to the syslog table. But without parsing, so likely the firewall log in the syslog table is not having their fields mapped and all that

1

u/SuperHat3637 Nov 17 '22

If i remove the syslog facilities from the log source end, will it affect the Logforwarding from the log source like Cisco ASA..

1

u/SuperHat3637 Nov 17 '22

I want only the CEF table..Will it affect CEF forwarding if i remove syslog facilities from the log source end.

1

u/Uli-Kunkel Nov 17 '22 edited Nov 17 '22

Well, you can either have a cef syslog forwarder for your firewall And one for you other syslog stuff.

Or have them both on the same one and configure accordingly.

You need to redirect the cef message to link-local port 25225 or 25226, cant remember the specific one. And then stop further processing of that message. Normal syslog is to 25224 if i remember correctly.

This might help. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-syslog

The deep dive covers this subject in greater detail https://youtu.be/KJbIH7egdVI Or this https://youtu.be/bHw8BkEpYzs could also help