FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
Andy_G
Staff
Staff
Article Id 195758

Description

Summary of Topic

You have syslog events from a device that AccelOps supports yet the Event Type is being assigned Unknown_EventType.

 

Solution Steps

Currently AO parsers require a PRID in the syslog header in order to be parsed correctly.

Example of a syslog event with a PRID:

Aug 22 12:31:07.418: %SYS-5-CONFIG_I: Configured from console by joeadmin on vty0 (10.10.10.10)

And here is how AO parses this event:

agodwin_FD39560_tn_FD39560-1.jpg

Example of a syslog event without a PRID:

<187>47258: Aug 22 12:31:07.418: %SYS-5-CONFIG_I: Configured from console by joeadmin on vty0 (10.10.10.10)

And here is how AO parses this event:

agodwin_FD39560_tn_FD39560-2.jpg

NOTE:

This will be optional starting in version 3.7.1.

Version Application

All < 3.7.1

 

 

 

Contributors