topic Re: Fowarding to syslog- best practice in General Topics

Fowarding to syslog- best practice

fmurray — Fri, 01 Mar 2019 19:49:39 GMT

Currently we forward nearly all of the firewall's logs to our syslog server, but the amount of irrelevant minutiae is over-whelming the syslog server.

Is there a best-practice for what information should be forwarded to syslog? I don't want to miss anything important but I ready want to eliminate the un-important.

Thanks

Re: Fowarding to syslog- best practice

OtakarKlier — Fri, 01 Mar 2019 20:29:44 GMT

Hello,

Honestly that is a 'it depends' answer as every one has a different set of requirements and thing sthey alert on. We also send everything to our SIEM but so that it can be correlated with other logs and events. While some traffic may look beging, it could actually be malicious.

I know its not a great answer, but we scalled out SIEM to handel everything at only 60% capacity.

Regards,

Re: Fowarding to syslog- best practice

BPry — Sat, 02 Mar 2019 20:53:38 GMT

@fmurray,

As @OtakarKlier mentioned this isn't something you could really make a best-practice on, as nobody has the same requirements. Personally, I like having all of the logs we can get into the SIEM and find it cheaper to just upgrade the device to function under the required load.

However, if your SIEM isn't able to handle that load you'll need to actually go through and determine the most important logs for your organization that you want to forward to your SIEM. That could mean that you only forward traffic for external access rules, or maybe access to your server infrastructure. That all depends on what your organizational needs are.

Re: Fowarding to syslog- best practice

Mick_Ball — Mon, 04 Mar 2019 12:30:40 GMT

@fmurray , FYI.

I have just about everything going to syslog, including Global Protect. this is our corp policy and to do with legal stuff.

we have logrotate that zips files up and deletes them after a required ammount of time.

the information is quite overwhelming but with various scripts you can pull out the information you require.

very rarely use it for traffic reports but every month reports are run for GlobalProtect activity.