Disabling local system.syslog ingestion

[rozahp]

Hi!

I'm new to SO and I'm testing SO 2.4 on an older computer (old processor but with 64GB mem) and would like to disable ingestion of system.syslog. I've googled and searched the documents without any result. Can anyone point me in the right direction? I'm a senior *nix user and know my way around but new to SO. Thanks a lot for any help. Cheers.

[cm-ops]

Do you want to keep the other system logs (Auth)? System logs are brought in by the system integration in Elastic Fleet that is assigned to an agent policy. https://docs.securityonion.net/en/2.4/elastic-fleet.html#agent-policies

[rozahp]

Hi and thanks for reply.

I edited the config files under salt/elasticfleet/files/integrations/ and changed to false those entries with "system.syslog" without any effect after running so-checkin.

I have exactly the same issue as in this thread:

#12418

I am testing SO Eval and SO Standalone on 2 different systems. Everything is working great accept the issue as discribed in the attached link.

I have run so-checkin and soup a number of times without any resolution.

Regards

[rozahp]

Fixed it by disabling log through the ElasticFleet agent policy configuration from SO menu. Still seeing some few "auth_method_missing".