system.syslog Missing

[ShalvaGiorgadze]

Version

2.4.60

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16

Storage for /

40G

Storage for /nsm

108G

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I am new to SO, just installed it from official SO image to VMware environment. When examining dashboard, noticed a lot of system.syslog Missing events. Is this normal? How to fix this situation?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

If you look at one of the logs what do you see event.category field with any value?

[ShalvaGiorgadze]

I switched to the table view, if this is what you are asking and there a lot of logs with event.category *Missing

[cm-ops]

Looks like some of your data is coming in and there is nothing in that field. Drill down into the logs to see what the traffic is. Look at the message field and see if there is a category field in the message.

[ShalvaGiorgadze]

Thank you for support. I have opened several messages, but there is no category field. This is the error.message filed, maybe this will be of help:
error.message: failed in Fleet agent final_pipeline: field [created] not present as part of path [event.created]