☰

Message 1 of 1

Good Morning,

During a failover test, we noticed that logs from EPO stopped flowing because the SIEM was configured to collect logs based on IP address. I was wondering if there was a way to configure log collection with hostname.

If not possible, are there any alternatives that may work similarly? We do not want to have 2 seperate log sources, one that is the primary and another failover source. This will always result in at least 1 being offline at all times.

Thank You,

Scott Blasing