topic Re: Disable User-ID Syslog messages in General Topics

Disable User-ID Syslog messages

DIRTT — Fri, 09 Mar 2018 16:25:33 GMT

I get litterally millions of the syslog messages below (different users), and I think that they have to do with the user-id agent or user identification in someway. Currently I am logging absolutely everything to a syslog server that pumps it all over to a SoC. I would like to disable these syslog messages. Does anyone have any ideas on this?

03 08 2018 09:06:55 10.3.1.25 <USER:INFO> Mar 8 08:06:55 MYFIREWALL.MY.DOMAIN 1,2018/03/08 08:06:54,009401021293,16114956,0x8000000000000000,USERID,login,51,2018/03/08 08:06:54,17,0,0,0,,MYFIREWALL.MY.DOMAIN,1,vsys1,10.1.120.69,domain\username,XXX,0,1,2700,0,0,agent,,0,0,,2018/03/08 08:06:54,1

Re: Disable User-ID Syslog messages

BPry — Sun, 11 Mar 2018 01:50:53 GMT

@DIRTT,

Well...If your logging everything to a syslog server then it would make sense that you are getting these messages ;-).

Under 'Log Settings' what does your configuration look like? My guess would be that within 'User-ID' you are forwarding all-logs to your Syslog server, which is why you are recieving these log messages.

Re: Disable User-ID Syslog messages

DIRTT — Wed, 14 Mar 2018 20:01:28 GMT

Sorry for the delay ... now that I have a chance to work on this again I saw that User-ID was set to send to the syslog server **facepalm** ... I will see if the changes made fixes the issue.