Filtering the log file for comment lines

The event log file for Microsoft ISA or Microsoft TMG might contain comment markers. Comments must be filtered from the event message.

1. From the Start menu, select All Programs > Syslog-ng Agent for Windows > Configure syslog-ng Agent for Windows.

   The Syslog-ng Agent window is displayed.

2. Expand the Syslog-ng Agent Settings pane, and select Destinations.
3. Right-click on your IBM QRadar Syslog destination and select Event Filters > Properties.

   The Global event filters Properties window is displayed.

4. Configure the following values:
   • From the Global file filters pane, select Enable.
   • From the Filter Type pane, select Black List Filtering.
5. Click OK.
6. From the Filter List menu, double-click Message Contents.

   The Message Contents Properties window is displayed.

7. From the Message Contents pane, select Enable.
8. In the Regular Expression field, type the following regular expression:

   ^#

9. Click Add.
10. Click Apply, and then click OK.

    The event messages with comments are no longer forwarded.

    Note: You might need to restart Syslog-ng Agent for Windows service to begin syslog forwarding. For more information, see your BalaBit Syslog-ng Agent documentation.