Need to determine what logs I am not ingesting.....Help

[Anonymous]

Good Morning,

We have about 1600 windows servers in multiple domains with the snare client sending to a central syslog server that forwards to one of our log hybrids.  I am only seeing around 700 servers getting to the log hybrid.  I need to determine which servers are not getting through the firewalls.  Is there a way to run a report of DNS names getting to the log hybrid?  If I had the domains that are being ingested I could determine which domains are not getting through.

Thanks for any help,

John

[huanzhou1]

select device.name.

can you monitor the device ips from logdecoder-stats.

[Anonymous]

Thanks.

How can I run a report to list all IP's?

John

[huanzhou1]

yes, you can. select device.ip, don't put any limit.