I came across a workaround that was suggested in an unofficial capacity by someone at AppDynamics during their local lab explorations. While this solution isn't officially supported by AppDynamics, it has proven to be effective for adjusting the log levels for both the Proxy and the Watchdog components within my AppDynamics setup. I'd like to share the steps involved, but please proceed with caution and understand that this is not a sanctioned solution. I recommend changing only the log4j2.xml file, because the proxy messages look like are responsible for almost 99% of the log messages. Here's a summary of the steps: Proxy Log Level: The log4j2.xml file controls this. You can find it within the appdynamics_bindeps module. For example, in my WSL setup, it's located at /home/wsl/.pyenv/versions/3.11.6/lib/python3.11/site-packages/appdynamics_bindeps/proxy/conf/logging/log4j2.xml. In the Docker image python:3.9, the path is /usr/local/lib/python3.9/site-packages/appdynamics_bindeps/proxy/conf/logging/log4j2.xml. Modify the seven log level itens <AsyncLogger> within the <Loggers> section to one of the following: debug, info, warn, error, or fatal. Watch Dog Log Level: This can be adjusted in the proxy.py file found within the appdynamics Python module. For example, in my WSL setup, it's located at /home/wsl/.pyenv/versions/3.11.6/lib/python3.11/site-packages/appdynamics/scripts/pyagent/commands/proxy.py. In the Docker image python:3.9, the path is /usr/local/lib/python3.9/site-packages/appdynamics/scripts/pyagent/commands/proxy.py. You will need to hardcode the log level in the configure_proxy_logger and configure_watchdog_logger functions by changing the level variable. My versions $ pip freeze | grep appdynamics appdynamics==24.2.0.6567 appdynamics-bindeps-linux-x64==24.2.0 appdynamics-proxysupport-linux-x64==11.68.3 log4j2.xml <Loggers> <AsyncLogger name="com.singularity" level="info" additivity="false"> <AppenderRef ref="Default"/> <AppenderRef ref="RESTAppender"/> <AppenderRef ref="Console"/> </AsyncLogger> <AsyncLogger name="com.singularity.dynamicservice" level="info" additivity="false"> <AppenderRef ref="DynamicServiceAppender"/> </AsyncLogger> <AsyncLogger name="com.singularity.ee.service.datapipeline" level="info" additivity="false"> <AppenderRef ref="DataPipelineAppender"/> <AppenderRef ref="Console"/> </AsyncLogger> <AsyncLogger name="com.singularity.datapipeline" level="info" additivity="false"> <AppenderRef ref="DataPipelineAppender"/> <AppenderRef ref="Console"/> </AsyncLogger> <AsyncLogger name="com.singularity.BCTLogger" level="info" additivity="false" > <AppenderRef ref="BCTAppender"/> </AsyncLogger> <AsyncLogger name ="com.singularity.api" level="info" additivity="false"> <AppenderRef ref="APIAppender"/> </AsyncLogger> <AsyncLogger name="com.singularity.segment.TxnTracer" level="info" additivity="false"> <AppenderRef ref="Default"/> <AppenderRef ref="Console"/> </AsyncLogger> <Root level="error"> <AppenderRef ref="Console"/> <AppenderRef ref="Default"/> </Root> </Loggers> proxy.py def configure_proxy_logger(debug): logger = logging.getLogger('appdynamics.proxy') level = logging.DEBUG if debug else logging.INFO pass def configure_watchdog_logger(debug): logger = logging.getLogger('appdynamics.proxy') level = logging.DEBUG if debug else logging.INFO pass Suggestion Change the hardcoded variables by environment variables: log4j2.xml file, change from [level="info"] to proxy.py file, change from [logging.DEBUG if debug else logging.INFO] to [os.getenv("APP_APPD_WATCHDOG_LOG_LEVEL", "info").upper()] Warning Please note, these paths and methods may vary based on your AppDynamics version and environment setup. Always backup files before making changes and be aware that updates to AppDynamics may overwrite your customizations. I hope this helps!

Step 1: Prerequisites: a. Splunk® Universal Forwarder w/Splunk_TA_nix installed b. "Package.sh" should be enabled similar to the example below Note: that the UF needs to be restarted to enable the input if it was previously started without the input. Step 2: Deploy the updated inputs / app If you need to deploy the app out, you'll only need to deploy it to Linux hosts. Do make sure you enable splunkd restart on your app deployment Step 3. Detect the CVE Now allow time for the data to arrive at your indexing tier and you should be able to run this search as a detection source=package sourcetype=package NAME=xz-libs VERSION IN ("5.6.0","5.6.1") Note: You may need to add index=os or index=Your_Linux_TA_Data_Index_here, but by default the data will be in index=main You'll probably want to take the search a few steps further. First thing that comes to our mind is adding a "| stats latest(_time) as latest_time by host". When you manipulate _time like that you'll notice it converts to epoch, so you'll probably want to convert it back to human readable format with "| convert ctime(latest_time)". The full search might look something like this: source=package sourcetype=package NAME=xz-libs VERSION IN ("5.6.0","5.6.1") | stats latest(_time) as latest_time by host | convert ctime(latest_time) If anyone else has anything to add, please reply or add your answer.