Setting up rsyslog servers using the CLI

To receive a daily notification for each entity that was the source of the event, enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message delivery daily-per-source

To receive an hourly notification for each entity that was the source of the event, enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message delivery hourly-per-source

To receive a notification every minute for each entity that was the source of the event, enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message delivery per-1min-per-source

To receive a notification every 5 minutes for each entity that was the source of the event, enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message delivery per-5min-per-source

To receive information about each event, sent when the event is triggered, enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message delivery per-event

To send notifications in the Common Export Format (CEF), enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message format cef

To send notifications in the comma-separated values (CSV) format, enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message format csv

To send notifications in the Log Extended Event Format (LEEF) (default), enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message format leef

To send notifications in XML Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message format xml-concise

To send notifications in XML Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (XML Extended provides all details about files and objects modified during analysis.), enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message format xml-extended

To send notifications in XML Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message format xml-normal

To send notifications in JSON Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message format json-concise

To send notifications in JSON Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (JSON Extended provides all details about files and objects modified during analysis.), enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message format json-extended

To send notifications in JSON Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message format json-normal

To send notifications in Text Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message format text-concise

To send notifications in Text Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (Text Extended provides all details about files and objects modified during analysis.), enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message format text-extended

To send notifications in Text Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message format text-normal

To indicate that action must be taken immediately (severity 1), enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message send-as alert

To indicate that the notification contains critical conditions (severity 2), enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message send-as crit

To indicate that the notification contains debug-level messages (severity 7), enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message send-as debug

To indicate an emergency (the system is unusable) (severity 0), enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message send-as emerg

To indicate that the notification contains error conditions (severity 3), enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message send-as error

To indicate that the notification contains informational messages (severity 6), enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message send-as info

To indicate normal but significant conditions (severity 5), enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message send-as notice

To indicate that the notification contains warning conditions (severity 4), enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> prefer message send-as warning

To select UDP, enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> protocol UDP

To select TCP, enter:

hostname (config) # fenotify rsyslog trap-sink <sink_name> protocol TCP