microsoft / microsoft/SysmonForLinux
Is there a possibility to change to OUTPUT file to a custom /var/log destination
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 2.2k
- Forks
- 220
- Avg merge
- 11d 22h
- Merged PRs (30d)
- 2
Description
Is there a possibility to change to OUTPUT file to a custom /var/log destination ?
In some cases you want to use for example /var/log/sysmon instead of the standard syslog, since it will overload the syslog for Linux admins. Additionally we can ensure that logging tools easily can harvest different formats without running to much reg matches.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how the current OUTPUT file is sent to standard syslog and where that destination is configured. Define a configurable custom /var/log destination that avoids overloading syslog and still lets logging tools harvest different formats; done means the requested destination and format behavior are supported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- observability-sre
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100