syslog data collection for log analytics workspace

Sugandha Kumari 1 Reputation point
2021-03-03T14:21:10.927+00:00

Dear Team,

I am using "az monitor data-collection rule create" and "az monitor data-collection rule syslog add" cli commands to collect syslogs data for linux VMs. It gives error as below:-

WARNING: Command group 'monitor data-collection' is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus
ERROR: BadRequestError: (InvalidPayload) Data collection rule is invalid

Please note I have created a log analytics workspace and connected the VMs.

Requesting your help on this.

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,800 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. SwathiDhanwada-MSFT 17,401 Reputation points
    2021-03-23T08:15:15.137+00:00

    @Sugandha Kumari I have tested the query from my end which worked successfully. The query documented in the az cli is bit incorrect which I have raised issue with content team. Kindly try below query and revert if you have further questions. 

     az monitor data-collection rule create --resource-group "swd" --location "westus2" --name "myCollectionRule" --data-flows destinations="swtry" streams="Microsoft-Perf" streams="Microsoft-Syslog" streams="Microsoft-WindowsEvent" --log-analytics name="swtry" resource-id="/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/swd/providers/Microsoft.OperationalInsights/workspaces/swtry" --performance-counters name="cloudTeamCoreCounters" counter-specifiers="\\Processor(_Total)\\% Processor Time" counter-specifiers="\\Memory\\Committed Bytes" counter-specifiers="\\LogicalDisk(_Total)\\Free Megabytes" counter-specifiers="\\PhysicalDisk(_Total)\\Avg. Disk Queue Length" sampling-frequency=15 transfer-period="PT1M" streams="Microsoft-Perf" --performance-counters name="appTeamExtraCounters" counter-specifiers="\\Process(_Total)\\Thread Count" sampling-frequency=30 transfer-period="PT5M" streams="Microsoft-Perf" --syslog name="cronSyslog" facility-names="cron" log-levels="Debug" log-levels="Critical" log-levels="Emergency" streams="Microsoft-Syslog" --syslog name="syslogBase" facility-names="syslog" log-levels="Alert" log-levels="Critical" log-levels="Emergency" streams="Microsoft-Syslog" --windows-event-logs name="cloudSecurityTeamEvents" transfer-period="PT1M" streams="Microsoft-WindowsEvent" x-path-queries="Security!" --windows-event-logs name="appTeam1AppEvents" transfer-period="PT5M" streams="Microsoft-WindowsEvent" x-path-queries="System!*[System[(Level = 1 or Level = 2 or Level = 3)]]" x-path-queries="Application!*[System[(Level = 1 or Level = 2 or Level = 3)]]"
  2. Sugandha Kumari 1 Reputation point
    2021-03-26T07:33:58.687+00:00

    I am not able to paste this as whole in comment so adding here the command I used.

    az monitor data-collection rule create --resource-group "RGName" --location "location" --name "myCollectionRule" --data-flows destinations="Workspacename" streams="Microsoft-Perf" streams="Microsoft-Syslog" streams="Microsoft-WindowsEvent" --log-analytics name="Workspacename" resource-id="/subscriptions/subscriptionID/resourceGroups/RGName/prov
    iders/Microsoft.OperationalInsights/workspaces/Workspacename" --performance-counters name="cloudTeamCoreCounters" counter-specifiers="\Processor(_Total)\% Processor Time" counter-specifiers="\Memory\Committed Bytes" counter-specifiers="\LogicalDisk(_Total)\Free Megabytes" counter-specifiers="\PhysicalDisk(_Total)\Avg. Disk Queue Length" sampling-frequency=15 transfer-period="PT1M" streams="Microsoft-Perf" --performance-counters name="appTeamExtraCounters" counter-specifiers="\Process(_Total)\Thread Count" sampling-frequency=30 transfer-period="PT5M" streams="Microsoft-Perf" --syslog name="cronSyslog" facility-names="cron" log-levels="Debug" log-levels="Critical" log-levels="Emergency" streams="Microsoft-Syslog" --syslog name="syslogBase" facility-names="syslog" log-levels="Alert" log-evels="Critical" log-levels="Emergency" streams="Microsoft-Syslog" --windows-event-logs name="cloudSecurityTeamEvents" transfer-period="PT1M" streams="Microsoft-WindowsEvent" x-path-queries="Security!" --windows-event-logs name="appTeam1AppEvents" transfer-period="PT5M" streams="Microsoft-WindowsEvent" x-path-ueries="System[System[(Level = 1 or Level = 2 or Level = 3)]]" x-path-queries="Application[System[(Level = 1 or Lev
    el = 2 or Level = 3)]]"

    0 comments