Buffer en Azure Monitor Agent

Question

We are migrating our onpremise SIEM to Azure Sentinel.
We have 3 forwarding servers with the AMA agent (2 syslog/CEF and 1 Wec).
We want that when a VPN tunnel goes down the agent buffer is able to store at least 10 GB.
Is this possible?
If not, what is the limit and where can we configure them for Linux and Windows agents?

Thank you very much

Answer 1

Hi @Abel Cajaraville Capote ,

Might be a bit late but the AMA currently has a 10GB buffer. The time which the agent can be offline and buffer those logs, relies solely on the Events Per Second that are received. Less events = more time, more events = less time.

With an estimation of your event size and the events per second, you are able to roughly determine for how long the AMA can handle and outage.

Additionally, Microsoft is working on a feature to expand the buffer from 10GB to 50GB via an AgentSetting DCR. Unfortunately, it's still in preview and currently not functioning properly.

You can find the relevant documentation here: Install and Manage the Azure Monitor Agent - Azure Monitor | Microsoft Learn

 

Kind regards, Alexandros

Answer 2

I am not certain if the AMA for Linux buffer can be configured. Much like the MMA, there is a buffer but the details do not appear to be published. I recommend working with your Microsoft support contacts to request more information if possible.

https://learn.microsoft.com/en-us/azure/azure-monitor/faq#what-happens-to-application-insight-s-telemetry-when-a-server-or-device-loses-connection-with-azure-