Custom Text Log DCR not Ingesting

Question

Hi,

I am struggling to determine why my Custom text DCR is not ingesting from a Linux box. I have tried just about every guide and troubleshooting site and still am not able to determine why this is not working. When ingesting the desired log file from a local linux server I manage it works, but when trying to ingest from the actual source server it just does.... nothing. No errors.

Here are the details:

1. Custom table in Sentinel created with RawData : string and TimeGenerated: DateTime
2. DCR created in same location as Custom table, same Resource Group and Subscription.
3. DCR has source server/resource with logs added which is an ARC / AMA enabled Linux resource in AWS.
4. DCE created in same Location, resource group and subscription as the Custom table and associated with DCR
5. No transformation used, left as source.

1. When looking at DCR metrics it is constantly moving up/down from 0 to 5 giving the impression something is being picked up. No dropped rows or Transform errors based on metrics.
2. Source Server is sending heartbeat via AMA.

1. No errors in DCRLogErrors

I am starting to think it may be connectivity issues or even permissions to read the log file?

i) Does AMA need specific file permissions on the folder it is picking the log files up from?

Thanks

Answer 1

Conradie, Francois F,
To ingest custom text logs from a linux or windows machines to sentinel workspace, you can refer this MS Doc for step-to-step detailed process.

So, coming to your issue there are few prerequisites for ingestion before connecting it through AMA. You need to have a specific RBAC permissions like "Monitoring contributor" to avoid any role related conflicts while log ingestion.

Refer MS Doc for more related information.

Now,

Does AMA need specific file permissions on the folder it is picking the log files up from?

As I given above, you can check access control with "getfacl" command and verify if the reader access existed for the specific log files/directories.

Also, make sure that the DCR has been correctly configured to read from the required file path and also check that the AMA status is successfully running to collect and send the logs.

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.

Answer 2

Update to the problem: AMA agent did not have permissions to read the log file on the source server as it was a mount drive (/mnt/appname/logs) and not a local drive.

I am busy checking if AMA can be configured to have rights, or alternatively change the location of the logs to a local drive.