Blah nevermind. We had a WAF logging to the same local log. I tweaked Tripwire to log to local5 on LEM and I'm seeing it correctly now.
↧
Blah nevermind. We had a WAF logging to the same local log. I tweaked Tripwire to log to local5 on LEM and I'm seeing it correctly now.