topic Re: Reduce Identity Awareness Logging in Firewall and Security Management

Reduce Identity Awareness Logging

Sam2 — Tue, 04 Apr 2023 14:51:44 GMT

We have a fairly large deployment and I am leveraging the IDC to get identities. Daily I am producing more IA logs than I am traffic logs, close to 800K per day.

We do not have enough users to produce 800K logs, and a majority of these logs are the same users being reported as logging in/out across multiple gateways subscribed to the same IDC feeds.

Is there any way I can turn off the login/logout logs and just have the logs enriched by the identities?

Thanks

Re: Reduce Identity Awareness Logging

the_rock — Tue, 04 Apr 2023 16:10:04 GMT

Hey @Sam2

Can you check what below is set to?

Andy

Re: Reduce Identity Awareness Logging

Sam2 — Wed, 12 Apr 2023 21:31:53 GMT

RDP events are ignored but machine IDs were not. I am setting machine IDs off for my 3 controllers and ill see what the reduction looks like.

Thanks!

Re: Reduce Identity Awareness Logging

Sam2 — Tue, 18 Apr 2023 13:54:54 GMT

This worked great, 500k less logs a day!

Thanks!

Re: Reduce Identity Awareness Logging

the_rock — Tue, 18 Apr 2023 13:55:50 GMT

Good job @Sam2 👍👍