Syslog - Linux Host

The Syslog - Linux Host log source and its processing rules are provided as a template to accommodate a plethora of applications. Customers are advised to modify this log source to suit their specific needs. Using this log source without modifications will cause performance issues, including slower log collection and suboptimal log parsing.

For information on modifying this template and optimizing log parsing, see Optimize Linux Host Processing below.

Supported Log Messages

(List of LR Tags used to parse the log information for each message type)

Optimize Linux Host Processing

The sheer number of Linux Host log messages can cause system processing issues if incoming logs are not matching beyond the Catch-All level rules. This section details the process to optimize the Linux Host log processing policies when performance is poor and causing an MPE performance constraint.

Prerequisites

• The lps_detail.log from affected data processors. This log can be found by default at C:\Program Files\LogRhythm\LogRhythm Mediator Server\logs.

Step 1: Find Non-Matching Parent Rules

1. Open the lps_detail.log file and locate the target MPE policy.
   The most important columns here are Total Compares, Attempts, and % Match.

   

   Parent rules not matching display 0.00% under the Match column. Refer to the screenshot below as an example.

   

Step 2: Clone the Existing MPE Policy

From the LogRhythm Client Console:

1. On the main toolbar, click Deployment Manager.
2. Click the Log Processing Policies tab.
3. Right-click within the grid and select New.
4. Search for the target log source type (e.g., Syslog - Linux Host), and then click OK.
   The MPE Policy Editor window appears.

Step 3: Create the New Policy with Only Matching Rules

The lps_detail.log file is referenced frequently during this step.

From the MPE Policy Editor window:

1. Enter a new, unique policy name.

2. Paste a parent rule from the lps_detail.log file into the Parent Rule Name column as shown below:
   

   

   
   This filters the list to show all sub-rules within the parent rule.
   

   Ensure only the parent rule chosen displays in the Parent Rule Name column.

3. Right-click and select Check All Displayed.
4. Right-click and select Properties.
5. Click Enable.
   All sub-rules are checked in the Enabled column.
6. Repeat steps 2 through 5 in this section for all matching parent rules.
7. Once all parent rules are enabled, repeat steps 2 through 5 in this section for all Catch-All level rules by searching for "Catch All:" under the Parent Rule Name filter.
8. Once complete, click OK.

Step 4: Apply the New Processing Policy to all Syslog - Linux Host Log Sources

From the LogRhythm Client Console:

1. On the main toolbar, click Deployment Manager.
2. Click the Log Sources tab.
3. Filter the lower grid so that all Syslog - Linux Host log sources display.
4. Right-click in the lower grid and select Uncheck All, then right-click again and select Check All Displayed.
5. Right-click in the lower grid and select Actions, and then Edit Properties.
   The Log Message Source Properties window appears.
   

   

6. Change the Log Message Processing Engine (MPE) Policy to the log processing policy created in the Step 3 section above.
   

   

Allow Changes to Take Effect

Once the steps above are completed, the Data Processor will implement the changes in its next cycle. A restart of the Mediator service is not typically required.

To confirm the updated policy is in place, review the updated lps_detail.log file to see the custom policy performance listed.

A manual restart of the Mediator can be performed if the lps_detail.log file doesn't reflect the new policy after about five minutes.

Revision History