Syslog nightmare

[RaphaelL]

Hi ,

We are currently busting our SIEM capacity due to Meraki limitation regarding syslogs. 

Eg : We have a client connected to an MR36 AP and the traffic is routed by an MX68. Syslog is enabled for flows,Urls. Logging is enabled on the rule. MX version is 18.107.5

Doing a get to www.microsoft365.com will generate :

1 "flows" on the AP and the MX

1 ip_flow_start on the MX ,

1 ip_flow_end on the MX ,

1 'URLS' on the AP 

1 'URLS' on the MX

1 'firewall' on the MX. 

7 syslog event for a simple get. Mutiply that for 40K users and we have our nightmare. 

1- Removing the 'logging' for the web browsing rule will only remove the 'firewall' logs.

2- Removing 'flows' from the syslog configuration will remove ALL ip_flow AND firewall logs

Ughhh , I can't seem to be able to find a solution. 

[KarstenI]

I can only think about a Linux box that receives the flows, filters out everything you don't want, and forwards the rest to the SIEM.

[CptnCrnch]

This is not a Meraki native issue, we're seeing this with a lot of customers and their log sources. As @KarstenI mentioned, there are several options from syslog-ng up to expensive commercial offering that are used to "pre-filter" logs going to the SIEM.

[RaphaelL]

I agree. By "Meraki's limitation" I meant to limited segmentation between flows (start/end) and firewall rule logging. 

By disabling the flow start/end , that would solve 90% of my issues.

[rhbirkelund]

I think you should call your local SE(/TSE), raise the issue, and have them work with their internal team on this.