# How can I stop sending fast.log alerts via syslog? **URL:** \ **Category:** Help\ **Created:** [December 16, 2021, 11:25am UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030 "2021-12-16T11:25:53Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Koifman](https://avatars.discourse-cdn.com/v4/letter/k/ea5d25/32.png) [@Koifman](https://forum.suricata.io/u/Koifman)\ **Post date:** [December 16, 2021, 11:25am UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030/1 "2021-12-16T11:25:53Z")
Hey community, so I just started learning how to configure Suricata and syslog from scratch - that was quite a learning experience. I managed to reach a configuration template that is suitable for me. However, I’m getting both of eve.json alerts, and fast.log alerts, which is redundant. I want to stop sending the fast.log alerts, but I could not find ANY combination or setting change on the config file to stop sending them. Here’s a photo to show what I mean ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/3/36d4dd210f181b22e9b51d5b03a8fa01a5610144.png) The lines that are marked in red are lines I don’t want to send to my QRadar anymore. And this is my config file: [suricata.yml](https://forum.suricata.io/uploads/short-url/kR23PLrWln6RAwihwRnP1IOGb4n.yml) (72.8 KB) Help would be highly appreciated. Thank you! ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [December 16, 2021, 2:53pm UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030/2 "2021-12-16T14:53:01Z")
Change `enabled: yes` to `enabled: no` in your `suricata.yaml` file as shown below to disable `fast.log` writing. ```auto outputs: # a line based alerts log similar to Snort's fast.log - fast: enabled: no filename: fast.log append: yes filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' ``` ---
**Author:** ![Koifman](https://avatars.discourse-cdn.com/v4/letter/k/ea5d25/32.png) [@Koifman](https://forum.suricata.io/u/Koifman)\ **Post date:** [December 16, 2021, 5:42pm UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030/3 "2021-12-16T17:42:45Z")
Hey Jeff, thanks for the reply. That was one of the first things I’ve tried. I can confirm indeed that the log is not being written anymore, but the alerts in the format of fast.log are STILL being sent via syslog. Is there any way to troubleshoot this? ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [December 16, 2021, 7:24pm UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030/4 "2021-12-16T19:24:18Z")
Ok … then find this section ```auto # a line based alerts log similar to fast.log into syslog - syslog: enabled: yes # reported identity to syslog. If omitted the program name (usually # suricata) will be used. identity: "suricata" facility: local5 #level: Info ## possible levels: Emergency, Alert, Critical, ## Error, Warning, Notice, Info, Debug ``` and change `enabled: yes` to `enabled: no` as shown: ```auto # a line based alerts log similar to fast.log into syslog - syslog: enabled: no # reported identity to syslog. If omitted the program name (usually # suricata) will be used. identity: "suricata" facility: local5 #level: Info ## possible levels: Emergency, Alert, Critical, ## Error, Warning, Notice, Info, Debug ``` ---
**Author:** ![Koifman](https://avatars.discourse-cdn.com/v4/letter/k/ea5d25/32.png) [@Koifman](https://forum.suricata.io/u/Koifman)\ **Post date:** [December 19, 2021, 9:07am UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030/5 "2021-12-19T09:07:01Z")
> [@Jeff\_Lucovsky](#): > > `a line based alerts log similar to fast.log into syslog` Hey Jeff, thanks for the reply. When I perform this change and restart the service - no logs AT ALL are being sent to QRadar. I have to change the “enabled” back to YES in order to fix it. ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [December 19, 2021, 1:22pm UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030/6 "2021-12-19T13:22:29Z")
Sounds like you need the fast.log-style alerts going to syslog for QRadar’s benefit. Regarding your original question, while you can disable those alerts, your deployment scenario requires them (for QRadar). ---
**Author:** ![Koifman](https://avatars.discourse-cdn.com/v4/letter/k/ea5d25/32.png) [@Koifman](https://forum.suricata.io/u/Koifman)\ **Post date:** [December 19, 2021, 1:30pm UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030/7 "2021-12-19T13:30:00Z")
Not sure if I understand - I need only the flow logs(the ones that are not marked in red in the initial photo). The fast.log alerts (the ones that ARE marked in red) I don’t need. And this is just a lab I’m testing, I don’t have any deployment scenario I need to follow. ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [December 19, 2021, 3:43pm UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030/8 "2021-12-19T15:43:43Z")
Ok … I’m a little confused too. Your `suricata.yml` file shows logging enabled for - `fast.log` via `outputs.fast.enabled` - EVE logging (via syslog) via `outputs.eve-log.enabled` - `fast.log`-style alerts via `outputs.syslog.enabled` The last bullet addresses your comment: > [@Koifman](#): > > alerts in the format of fast.log are STILL being sent via syslog. ---
**Author:** ![Koifman](https://avatars.discourse-cdn.com/v4/letter/k/ea5d25/32.png) [@Koifman](https://forum.suricata.io/u/Koifman)\ **Post date:** [December 19, 2021, 8:07pm UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030/9 "2021-12-19T20:07:47Z")
I see… I think what happens is that outputs.syslog.enabled is also applied to the EVE logging, because when I turn it off - everything turns off with it. What I’m trying to understand is whether there is a seperate logging control JUST for fast.log alerts, I’m just unable to find it. Not the end of the world, would be nice to know though. ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [December 19, 2021, 8:38pm UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030/10 "2021-12-19T20:38:13Z")
Hmm, I’m not able to reproduce the issue that you’re seeing. As I mentioned, there are 3 controls - `fast.log` - `eve.json` - fast.log-style alerts to syslog I regularly develop/test with the first 2 enabled. I am able to enable all 3 and receive log content in `fast.log`, `eve.json`, and `/var/log/syslog`. I am able to disable the first and 3rd items without stopping the logging to `eve.json` (alerts and logs). What version of Suricata are you using (`suricata -V`)? What command line do you start suricata with (on Linux, `cat /proc/$(pidof suricata)/cmdline`). ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [December 19, 2021, 8:58pm UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030/11 "2021-12-19T20:58:01Z")
Just wanted to confirm that I tested with `fast` having `enabled: no`, `eve-log` having a `filetype` of `syslog`, and the actual `syslog` output left at default (disabled). All my EVE (json formatted logs) are indeed going to syslog, even with syslog output disabled. This is with Suricata 6.0.4 on Linux. ---
**Author:** ![Koifman](https://avatars.discourse-cdn.com/v4/letter/k/ea5d25/32.png) [@Koifman](https://forum.suricata.io/u/Koifman)\ **Post date:** [December 21, 2021, 9:25am UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030/12 "2021-12-21T09:25:34Z")
Managed to make it work somehow, not quite sure even how. Thanks anyway! ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [December 21, 2021, 1:11pm UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030/13 "2021-12-21T13:11:27Z")
Can you post the Suricata config file? We have an earlier one from you and I’d like to compare it with the one that provides proper behavior. Thanks ---
**Author:** ![Koifman](https://avatars.discourse-cdn.com/v4/letter/k/ea5d25/32.png) [@Koifman](https://forum.suricata.io/u/Koifman)\ **Post date:** [December 21, 2021, 1:25pm UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030/14 "2021-12-21T13:25:41Z")
It’s exactly the same as far as I know, but here it is again: [suricata.yaml](https://forum.suricata.io/uploads/short-url/AoOaeBvCTzpAK7XO3sSzyFdeEQA.yaml) (71.0 KB) ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [December 23, 2021, 1:41pm UTC](https://forum.suricata.io/t/how-can-i-stop-sending-fast-log-alerts-via-syslog/2030/15 "2021-12-23T13:41:22Z")
I’m glad it’s working for you and I confirmed that both configuration files are the same.