Sometimes you want to collect log sources in QRadar but logs keep coming with localhost in the syslog header and QRadar assigns localhost as the log source identifier which is a really bad thing. Don't worry, patching this problem is very easy and often comes from the server you want to collect.
Connect to your server and verify the hosts file, located in /etc/hosts for Linux. You will, for sure, find this kind of configuration:
127.0.0.1 localhost myhostname myhostname.comYou simply have to change the order of resolution by moving localhost at the end like that:
127.0.0.1 myhostname myhostname.com localhostWrite the change and observe new logs coming with myhostname in the syslog header in place of localhost before.
You reach the end of this article, huge thanks for reading 🫶
👨👩👧👦 To become a more friendly guru of QRadar, join the community on Github and leave a ⭐.
🤗 To become a nicer guru of QRadar, leave a comment, your feedback will always be welcome (when constructive of course).
Be the first to comment.