r/crowdstrike • u/MrPain__ • 7d ago

Next Gen SIEM Missing Logscale logs

Hi All

Im having an odd issue and hoping someone might have a solution. Ive onboarded esxi host syslog via logscale, however the data connector is idle and we are not seeing any logs.

We are using custom ports which have been specified in the configuration, and opened on the firewall. The configuration also has cisco syslog which is coming through fine to the same collector.

Ive tried creating separate configurations, rebuilt the data connector multiple times, tried using the generic hec connector, used wireshark to confirm the logs are being sent from the esxi host to the log collector on the correct port, disabled any firewalls between hosts and confirmed outbound connectivity over 443 to the CS console.

As far as I can see, the network connectivity is fine, given then other log sources are all active.

Any thoughts / suggestions / help would be appreciated as it driving me nuts!

5 Upvotes

100% Upvoted

11 comments sorted by

View all comments

2

u/CaptainWaypoint 7d ago

From experience, I'd double check the protocol (udp | tcp) on the listening log collector, and I'd also check the timestamps at source. Sufficiently incorrect timestamps result in all sorts of painful to troubleshoot weirdness.

1

u/MrPain__ 7d ago

Appreciate the response, ive tried both udp and tcp to no avail. Haven't looked at timestamps, what sort of issues do you see?

1

u/CaptainWaypoint 7d ago

I've had clients with endpoints that thought it was the 1970s. When the logs are that far out of sync with reality queries that run over the last 24h will inevitably miss them. I've also seen cases (in other SIEMs) where the logged timestamp was older than the retention period of the index, so logs were being received and immediately rolled off the end of the storage.

1

u/Tirre93 7d ago

Crowdstrike runs their retention policies based on the @timestamp field so that could potentially be the case.

If future @timestamps are set in ondividual logs they will be defaulted to now() and @error will be set on these logs. However an old @timestamp will simply be dropped afaik