KQL for Service Stopped in Linux

Question

Hi All, We have some Linux servers with some services running on them. Can some one provide the KQL query to check if the services like sshd, rsyslogd and crond or cron are in stopped state using Syslog. For windows we can have query like Event |where EventLog=="System" and EventID==7036 and Source =="Service Control Manager". Looking for similar kind of query for Linux. TYIA

Answer 1

Hi @SujinaSJ-1789 ,

As per this Azure document, equivalent of Event kusto table for Windows is Syslog kusto table for Linux. However, to monitor a service or deamon, recommended approach as per this section of the same Azure document is using kusto tables ConfigurationChange and ConfigurationData. As per your use case scenario, follow any of the approaches.

If you are looking for a sample using Syslog kusto table then for example, to check if services like sshd, rsyslogd, and crond or cron are in a stopped state on Linux using Syslog, you can use the following sample KQL query:

Syslog
| where Facility == "daemon" and (SyslogMessage contains "sshd" or SyslogMessage contains "rsyslogd" or SyslogMessage contains "crond" or SyslogMessage contains "cron") and SyslogMessage contains "exited with status 0"

This sample query would filter the Syslog table for messages from the daemon facility that contain the names of the services you want to check and have exited with a status of 0, which indicates a successful stop. You can adjust the query to include additional services or change the status code as needed.