Hello,
our customer tries to sent files to parser which are bigger than 65000 bytes. Is this a forwarder limitation? If it is, is there a nice solution to reduce the attributes for the AD user context files.
https://cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-windows-ad
Thanks for your help!
Best answer by manthavish
Hello,
Are you saying that one log line is exceeing 64KB for a AD User Context log ? If so, you can reduce the attributes passed by using the -Properties flag in the poweshell script to reduce the properties to pass.
Regarding the 64 KB limitation, that is a syslog limitation and not a forwarder limitation.
Hope this helps,
Mantha
+4Hello,
Are you saying that one log line is exceeing 64KB for a AD User Context log ? If so, you can reduce the attributes passed by using the -Properties flag in the poweshell script to reduce the properties to pass.
Regarding the 64 KB limitation, that is a syslog limitation and not a forwarder limitation.
Hope this helps,
Mantha
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
