What /var/log/ are sent to remote syslog?
First, we don't have HSL enabled (yet). Following an upgrade from 12.1.2 to 13.1.1.4, I ran into an issue where a guest went offline due to Bug ID 724556; processes are issued the kill command but do not actually get removed. The macabre log message is located in /var/log/restjavad.0.log. [SEVERE][3682][14 Apr 2019 10:25:37 UTC][ChildWrapper] Child runner thread was interrupted. Killing child: 05b5a0ab-c243-4fa6-bd66-ea37abc5d398 [SEVERE][3686][14 Apr 2019 10:25:37 UTC][ChildWrapper] Child runner thread was interrupted. Killing child: 05b5a0ab-c243-4fa6-bd66-ea37abc5d398 [SEVERE][3731][14 Apr 2019 10:27:37 UTC][ChildWrapper] Timed out waiting for GET request at http://localhost:8100/tm/sys/ha-status?options=all-properties. Killing child process 4046 [I][3732][14 Apr 2019 10:27:37 UTC][ChildWrapper] Killing IcrdChild process 4046 [SEVERE][3733][14 Apr 2019 10:27:37 UTC][ChildWrapper] Child runner thread was interrupted. Killing child: 0c6e6062-c135-4096-ac2f-d93e6713ea0d [SEVERE][3738][14 Apr 2019 10:27:37 UTC][ChildWrapper] Child runner thread was interrupted. Killing child: 0c6e6062-c135-4096-ac2f-d93e6713ea0d [SEVERE][3781][14 Apr 2019 10:29:37 UTC][ChildWrapper] Timed out waiting for GET request at http://localhost:8100/tm/sys/ha-status?options=all-properties. Killing child process 5436 [I][3782][14 Apr 2019 10:29:37 UTC][ChildWrapper] Killing IcrdChild process 5436 I am trying to set up an alarm when this message is sent. I don't see that message in our SIEM, so my question is, can /var/log/restjavad.0.log be sent to remote syslog?