Harmony Endpoint EDR logs flooding server's /var/log/message files

[BigHec]

Hi All,

Our client's do have few servers that are installed with Harmony Endpoint EDR. Recently they have a request whereby is it possible do not write the EDR logs into the server's /var/log/messages and write into another files instead?

As /var/log/messages contains many critical system logs related for the server or application related, there are too many of the EDR logs which flooded and overwrite the the previous /var/log/messages where results in the client unable to check on all the server/application systems logs.

Is it possible to do so that change or configure the EDR side to write the EDR logs into another files instead of writing into the server's /var/log/messages file?

Would like to ask do anyone have any idea on this?

Really appreciate for the reply.

Thank you