UDP Multiline Syslog log source parameters for PostFix MTA

Type the IP address, host name, or name to identify your PostFix MTA installation.

Type 517 as the port number used by QRadar to accept incoming UDP Multiline Syslog events. The valid port range is 1 - 65535.

To edit a saved configuration to use a new port number:

1. In the Listen Port field, type the new port number for receiving UDP Multiline Syslog events.
2. Click Save.
3. On the Admin tab toolbar, click Deploy Changes to make this change effective.

The port update is complete and event collection starts on the new port number.

Type the following regular expression (regex) needed to filter the event payload messages.

postfix/.*?[ \[]\d+[ \]](?:- - |: )([A-Z0-9]{8,})

Select this check box to enable the log source.

Select the credibility of the log source. The range is 0 - 10.

The credibility indicates the integrity of an event or offense as determined by the credibility rating from the source devices. Credibility increases if multiple sources report the same event. The default is 5.

Select the Target Event Collector to use as the target for the log source.

Select this check box to enable the log source to coalesce (bundle) events.

By default, automatically discovered log sources inherit the value of the Coalescing Events list from the System Settings in QRadar. When you create a log source or edit an existing configuration, you can override the default value by configuring this option for each log source.

Select this check box to enable the log source to store event payload information.

By default, automatically discovered log sources inherit the value of the Store Event Payload list from the System Settings in QRadar. When you create a log source or edit an existing configuration, you can override the default value by configuring this option for each log source.