
Explanation:
Box 1: Server1
On each source machine that sends logs to the forwarder in CEF format (SERVER1), you must edit the Syslog configuration file to remove the facilities that are being used to send CEF messages. This way, the facilities that are sent in CEF won't also be sent in Syslog.
Box 2: Server1
You must run the following command on those machines (the ones you ran it previously, i.e SERVER1) to disable the synchronization of the agent with the Syslog configuration in Microsoft Sentinel. This ensures that the configuration change you made in the previous step does not get overwritten Reference:
https://docs.microsoft.com/en-us/azure/sentinel/connect-log-forwarder?tabs=rsyslog#run-the-deployment-script