Filter LogRhythm Diagnostic Events

LogRhythm generates diagnostics logs and automatically stores these logs in the EventsDB. Administrators can configure their Data Processors to to filter out these logs and prevent them from being inserted into the EventsDB.

For each Data Processor in the environment:

1. Navigate to the Data Processor’s configuration file, scmedsvr.ini.

   1. The default location for this file is C:\Program Files\LogRhythm\LogRhythm Mediator Server\config

2. Edit the file by appending the following to the configuration:

   CODE

   [OPTIONAL]
   FilterEventIDs=

3. To filter out diagnostic events, add the Common Event ID’s of the diagnostic events, comma separated, to the FilterEventIDs parameter. For example:

   CODE

   [OPTIONAL]
   FilterEventIDs=-1100529,-1100445,-1000019

Note: Only negative values are accepted. Negative Common Event ID values are reserved for LogRhythm Diagnostic logs. To filter out other Common Events, use Global Log Processing Rules.

Common Diagnostic Logs

Below is a list of common diagnostic logs generated by the SIEM and their associated Common Event ID.