Integrating with secure transfer protocols (FTPS and Syslog – TLS) often requires additional settings or your firewall/proxy.į. Set the Receiver type to either FTP, FTPS, Syslog – UDP, or Syslog – TCP, or Syslog – TLS.If your log file format doesn't match this sample, you should add your data source as Other. Compare your log with the sample of the expected log format.If you select Custom log format to work with a network appliance that isn't listed, see Working with the custom log parser for configuration instructions. Select the appliance from the Source list.In the Defender for Cloud Apps portal, click the settings icon followed by Log collectors.įor each firewall or proxy from which you want to upload logs, create a matching data source.Go to the Automatic log upload settings page. Set up and configuration Step 1 – Web portal configuration: Define data sources and link them to a log collector If your setup typically exceeds 50 GB per hour, it's recommended that you split the traffic between multiple log collectors. In cases of congestion, the log collector starts to drop log files. The log collector has a built-in safety mechanism that monitors the rate at which logs arrive and compares it to the upload rate. I/O performance of the virtual machine - Determines the speed at which logs are written to the log collector's disk. Network bandwidth - Your network bandwidth determines the log upload speed. The main bottlenecks in the log collection process are:
The Log collector can successfully handle log capacity of up to 50 GB per hour. If you have an existing log collector and want to remove it before deploying it again, or if you simply want to remove it, run the following commands: docker stop
0 kommentar(er)
