Prisma Cloud Compute: How to whitelist writing messages to /var/log/messages

This article explains how we can whitelist defender writing messages to syslog i.e /var/log/messages.

• Prisma Cloud Compute Edition
• Prisma Cloud Enterprise Edition

• Please try the following steps:

  1. Go to /etc/rsyslog.d 
  2. Add a new conf file here let's say "Defender.conf" (vi Defender.conf) 
  3. Add below line in the Defender.conf file: if $msg contains "<write-your-message-here>" then stop 
  4. Save file.
  5.  Restart syslog server: sudo systemctl restart rsyslog