topic Re: Harmony endpoint logs to syslog server in Endpoint

Harmony endpoint logs to syslog server

BrunoCiongoli — Thu, 15 Feb 2024 14:17:52 GMT

Hi mates,

I have two questions about the "Event Forwarding" on infinity portal:

1- Is possible to calculate size of logs that harmony endpoint sent to syslog server before sending it? (This is to know how many disk size we have to assign to SIEM)

2-How often does the portal send the logs to the SIEM?

Thanks in advance

Re: Harmony endpoint logs to syslog server

PhoneBoy — Thu, 15 Feb 2024 17:47:39 GMT

To answer both questions, logs are sent as they are generated.
That makes it impractical to calculate how much will be sent beforehand.

Re: Harmony endpoint logs to syslog server

BrunoCiongoli — Fri, 16 Feb 2024 13:04:34 GMT

Thank you very much for the info!

Re: Harmony endpoint logs to syslog server

the_rock — Fri, 16 Feb 2024 20:14:04 GMT

Hey Bruno,

We have customers where we configured logs to be sent to siem solution and yes, Phoneboy is correct, they are sent in real time, so its almost impossible to tell what size they would be.

But, if you want a ballpark estimate, I can try figure it out for you, let me know.

Best,

Andy

Re: Harmony endpoint logs to syslog server

the_rock — Fri, 16 Feb 2024 20:28:41 GMT

Btw, I just took this from one client's environment for smart-1 cloud instance (cloud mgmt), but will try get it for harmony endpoint as well.

Best,

Andy

Re: Harmony endpoint logs to syslog server

the_rock — Sat, 17 Feb 2024 00:59:20 GMT

Hey Bruno,

One of my colleagues from SIEM team got back to me and let me know that on average, from client I was referring to, we get about 40 K logs a day. He can check the average log size Monday, and I can give you that info.

Best,

Andy

Re: Harmony endpoint logs to syslog server

the_rock — Sat, 17 Feb 2024 10:55:33 GMT

@BrunoCiongoli K, so found out its about 38-40 K logs a day, averaging 2 KB per log. Hope that info is somewhat useful : - )

Best,

Andy

Re: Harmony endpoint logs to syslog server

BrunoCiongoli — Mon, 19 Feb 2024 03:30:43 GMT

Thank you Andy! it was so helpful for me.

Re: Harmony endpoint logs to syslog server

the_rock — Mon, 19 Feb 2024 03:42:10 GMT

Glad we can help mate.

Best,

Andy