Skip to main content
Skip table of contents

Filter LogRhythm Diagnostic Events

LogRhythm generates diagnostics logs and automatically stores these logs in the EventsDB. Administrators can configure their Data Processors to to filter out these logs and prevent them from being inserted into the EventsDB.

For each Data Processor in the environment:

  1. Navigate to the Data Processor’s configuration file, scmedsvr.ini.

    1. The default location for this file is C:\Program Files\LogRhythm\LogRhythm Mediator Server\config

  2. Edit the file by appending the following to the configuration:


  3. To filter out diagnostic events, add the Common Event ID’s of the diagnostic events, comma separated, to the FilterEventIDs parameter. For example:


Note: Only negative values are accepted. Negative Common Event ID values are reserved for LogRhythm Diagnostic logs. To filter out other Common Events, use Global Log Processing Rules.

Common Diagnostic Logs

Below is a list of common diagnostic logs generated by the SIEM and their associated Common Event ID.

Diagnostic Log Common Event Name

Common Event ID

LogRhythm MPE Rule Performing Poorly


LogRhythm Agent Heartbeat Missed


LogRhythm Silent Log Source Error


LogRhythm Diagnostics Event


LogRhythm Agent Log Source Open Failed


LogRhythm Agent Failed Virtual Source Lookup


LogRhythm Agent Failed To Obtain File Stats


LogRhythm Agent Socket Connect Failure


LogRhythm Silent Log Source Resumed


LogRhythm Agent Syslogng Socket Option Failed


LogRhythm Silent Log Source Warning


LogRhythm Agent File Monitor Error


LogRhythm Agent Log Collection Start


LogRhythm Agent Heartbeat Resumed


LogRhythm Agent Syslog Socket Bind Failure


LogRhythm Message Storing


LogRhythm Mediator Invalid Connection Closed


LogRhythm Agent Bad Mediator Host


LogRhythm Agent File Exceeds Size Hash Limit


LogRhythm Mediator Invalid Protocol Msg Version


JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.