Share via

Load balancer for Azure Log Forwarder solution

zied 1 Reputation point
2022-10-19T08:56:57.937+00:00

Hello,
We are using the Log Forwarder solution to send CEF logs (through syslog) from on premises to Azure log analytics (used by Sentinel).
This is working fine.
The problem is, we have to add a new Log Forwarder server with a LodBalancer solution. We used HAProxy, but it doesn't work: we are receiving syslog messages and not the CEF messages.

Do you know which solution/configuration shall I use to have the Log Forwarder working with a Load Balancer solution (HAProxy or another one)?

Thanks for your help

Microsoft Security Microsoft Sentinel

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Givary-MSFT 35,621 Reputation points Microsoft Employee Moderator
    2022-10-25T06:48:15.46+00:00

    @zied Thank you for reaching out to us. Researched on this query, I suspect that the challenge is that due to the HAproxy configuration, the events are not received by RSyslog on the agent in the original format. I suspect that configuration changes to HAproxy, or tweaking the RSyslog configuration would help or you can use a Nginx server as the load balancer to distribute the messages between servers.

    Let me know if you have any further questions.

    1 person found this answer helpful.
    0 comments
  2. JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator
    2022-10-21T21:42:38.97+00:00

    @zied
    Thank you for your post!

    I understand that you're using a log forwarder to ingest Syslogs and CEF logs to Microsoft Sentinel from on-prem, and everything was working as expected. However, since you added a new Log Forwarder and integrated a new Load Balancer solution - HAProxy, you're receiving the Syslogs but not the CEF messages.

    • To troubleshoot these potential networking issues, you should be able to use something like Fiddler to help show why the CEF messages aren't being received.
    • You can also look into leveraging Azure-Arc so your on-prem server(s) can connect to Microsoft Sentinel.

    Additional Links:
    Network topology and connectivity for Azure Arc-enabled servers

    I hope this helps!

    If you have any other questions, please let me know.
    Thank you for your time and patience throughout this issue.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.