Syslog file format not matching with props.conf for SecureAuth IdP?

[youngca5]

So we are trying to implement the SecureAuth IdP app in our environment. We are able to get log files to generate out from SecureAuth, but when we are ingesting them into splunk no meaningful fields are extracted.

Currently in SecureAuth, we are using version 8.2, we have the "Syslog" option selected for Audit Logs, and when the file is ingested, we do not match up with any of the extractions in props.conf. Has anyone else had this issue, or know if there is a setting in SecureAuth to make the log file match the format splunk is expecting?

[abeeber_2]

I had this issue and it turns out the problem was with rsyslog.

rsyslog by default uses BSD for its log format. To get it to handle IEFT which is required by SecureAuth, I had to change the log format template to:

$ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format

As soon as did that, all the field extractions worked as expected.

[abeeber_2]

Did you find an answer to this question?