I have a few windows and SLES servers. I only want to collect authentication logs. I can customize rsyslog in SLES but in windows, all logs are being captured, How can I configure Graylog 4 so that only authentication [ success/failure] logs are stored in disk and the rest all logs are discarded.

How can I configure Graylog 4 so that only authentication [ success/failure] logs are stored in disk

tmacgbay (Tmacgbay) January 25, 2021, 7:59pm 7

Created a new post with the relevant tables here.

1 Like