IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Syslog protocol unable to identify logs to custom Log source

    Posted 11/04/20 07:50 AM
    I have configured custom Log source , firstly i configure log source type then i configure log source with this log source type and protocol type "syslog" with the log source identifier is FQDN that is sent in syslog message then i delopy changes. it works for some times then now it is not working and log coming as unknow and under category is unknown log event. 
    then i change identifier with IP Address of Syslog source or hostname but not working. although the same configuration was working before.
    note QRadar Version : 7.4.0

    ------------------------------
    Ahmed Hassan
    ------------------------------


  • 2.  RE: Syslog protocol unable to identify logs to custom Log source

    Posted 11/04/20 10:35 AM
    Hi Ahmed,

    you need to see sim generic logs and note down the host name, same host name you need to define while configuring log-source.

    Thanks

    ------------------------------
    robin jangid
    ------------------------------



Related Content