Hi everyone,

I'm setting up log forwarding from Linux servers to QRadar and trying to decide on the best approach from both a security and efficiency standpoint.

Sending all logs gives full visibility, but it creates a lot of noise and increases EPS. On the other hand, limiting to just authpriv or auditd keeps things cleaner, but I'm concerned about missing useful data.

What's considered best practice here? Do you forward everything, or only specific logs like auth, auditd, sshd, etc.? I'm aiming for a setup that catches key security events without overwhelming the SIEM.

Would really appreciate hearing how others have handled this in production.

------------------------------
Fariz Pirmatov
------------------------------

There's a lot of "it depends" here.  I'm not sure there's a one-size-fits-all answer.  Not everyone cares about all the same set of detections and different Linux distros set up logging a little differently.

Definitely starting with auth, authpriv facilities is a good idea. auditd is a great source of data for process starts/stops, privileged command execution, etc, etc but there's a fair bit of work involved in setting up the rules to make good use of it. I like setting up a specific filter for firewall events as well (ubuntu does this by default for UFW). In some cases, if you don't mind the extra volume, you could send everything that's WARN severity or higher. 

------------------------------
Rory Bray
Security and Compliance Architect, Threat Management
IBM
------------------------------

The way we do it is for linuxes that use rsyslogd, we have a custom config file that selectively filters the types of logs we don't care about and forwards the remainder to QRadar. On the event processor side, you could use routing rules to drop events, but a percentage of those count against your EPS, so we write and test filters with routing rules and then implement them in rsyslog.conf. 

------------------------------
Michael Richards
------------------------------

When creating or modifying rules, we check whether additional logs are required. So above all, the existing rules determine which logs are forwarded. But of course, some logs are always forwarded.

@Michael Richards : Do you use encryption when forwarding syslog? If I understand correctly, there is no supported way to forward with encryption. And I wonder if it makes sense to use an unsupported way. 

------------------------------
Reinhard Westerholt
------------------------------

Original Message:
Sent: Tue June 10, 2025 07:48 AM
From: Michael Richards
Subject: Optimizing Linux Log Forwarding to QRadar – Best Practices?

The way we do it is for linuxes that use rsyslogd, we have a custom config file that selectively filters the types of logs we don't care about and forwards the remainder to QRadar. On the event processor side, you could use routing rules to drop events, but a percentage of those count against your EPS, so we write and test filters with routing rules and then implement them in rsyslog.conf. 

------------------------------
Michael Richards
------------------------------

rsyslogd will definitely do encrypted forwarding if needed. See $ActionSendStreamDriverAuthMode, $ActionSendStreamDriverMode, and  $DefaultNetstreamDriver

------------------------------
Rory Bray
Security and Compliance Architect, Threat Management
IBM
------------------------------

Original Message:
Sent: Wed June 11, 2025 05:49 AM
From: Reinhard Westerholt
Subject: Optimizing Linux Log Forwarding to QRadar – Best Practices?

When creating or modifying rules, we check whether additional logs are required. So above all, the existing rules determine which logs are forwarded. But of course, some logs are always forwarded.

@Michael Richards : Do you use encryption when forwarding syslog? If I understand correctly, there is no supported way to forward with encryption. And I wonder if it makes sense to use an unsupported way. 

------------------------------
Reinhard Westerholt
------------------------------


Original Message:
Sent: Tue June 10, 2025 07:48 AM
From: Michael Richards
Subject: Optimizing Linux Log Forwarding to QRadar – Best Practices?

The way we do it is for linuxes that use rsyslogd, we have a custom config file that selectively filters the types of logs we don't care about and forwards the remainder to QRadar. On the event processor side, you could use routing rules to drop events, but a percentage of those count against your EPS, so we write and test filters with routing rules and then implement them in rsyslog.conf. 

------------------------------
Michael Richards