Configuring rsyslog settings

Use the CLI commands in this topic to set up the default configuration for rsyslog notifications.

To configure rsyslog settings:

Enable the CLI configuration mode:

hostname > enable
hostname # configure terminal

Enable rsyslog notifications:

hostname (config) # fenotify rsyslog enable

Specify the default format for rsyslog notifications:
Note
The json_legacy-concise, json_legacy-extended, and json_legacy-normal formats are deprecated.
- To send notifications in the Common Export Format (CEF), enter:
```
hostname (config) # fenotify rsyslog default format cef
```
- To send notifications in the comma-separated values (CSV) format, enter:
```
hostname (config) # fenotify rsyslog default format csv
```
- To send notifications in the Log Extended Event Format (LEEF) (default), enter:
```
hostname (config) # fenotify rsyslog default format leef
```
- To send notifications in XML Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
```
hostname (config) # fenotify rsyslog default format  xml-concise
```
- To send notifications in XML Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (XML Extended provides all details about files and objects modified during analysis.), enter:
```
hostname (config) # fenotify rsyslog default format xml-extended
```
- To send notifications in XML Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
```
hostname (config) # fenotify rsyslog default format xml-normal
```
- To send notifications in JSON Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
```
hostname (config) # fenotify rsyslog default format json-concise
```
- To send notifications in JSON Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (JSON Extended provides all details about files and objects modified during analysis.), enter:
```
hostname (config) # fenotify rsyslog default format json-extended
```
- To send notifications in JSON Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
```
hostname (config) # fenotify rsyslog default format json-normal
```
- To send notifications in Text Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
```
hostname (config) # fenotify rsyslog default format text-concise
```
- To send notifications in Text Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (Text Extended provides all details about files and objects modified during analysis.), enter:
```
hostname (config) # fenotify rsyslog default format text-extended
```
- To send notifications in Text Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
```
hostname (config) # fenotify rsyslog default format text-normal
```
Specify that a notification is sent by default each time a malware object is detected:
```
hostname (config) # fenotify rsyslog default delivery per-event
```
Specify the default severity classification for the rsyslog notification:
Note
Trellix recommends setting the severity classification to alert.
- To indicate that action must be taken immediately (severity 1), enter:
```
hostname (config) # fenotify rsyslog default send-as alert
```
- To indicate that the notification contains critical conditions (severity 2), enter:
```
hostname (config) # fenotify rsyslog default send-as crit
```
- To indicate that the notification contains debug-level messages (severity 7), enter:
```
hostname (config) # fenotify rsyslog default send-as debug
```
- To indicate an emergency (the system is unusable) (severity 0), enter:
```
hostname (config) # fenotify rsyslog default send-as emerg
```
- To indicate that the notification contains error conditions (severity 3), enter:
```
hostname (config) # fenotify rsyslog default send-as error
```
- To indicate that the notification contains informational messages (severity 6), enter:
```
hostname (config) # fenotify rsyslog default send-as info
```
- To indicate normal but significant conditions (severity 5), enter:
```
hostname (config) # fenotify rsyslog default send-as notice
```
- To indicate that the notification contains warning conditions (severity 4), enter:
```
hostname (config) # fenotify rsyslog default send-as warning
```
Save the configuration:
```
hostname (config) # write memory
```