Azure Firewall Log Forwarding Issue

Question

Azure Firewall Log Forwarding Issue

Amit 0

Hey Team Azure,

I want to ask you a question regarding Azure Firewall. I want to Analyse Azure Firewall Logs in real time so I want Azure Firewall to forward logs to a Syslog Server where I can receive the logs and perform my analysis.

Please let me know how can I do this task and what tools I need for this.

Monalla-MSFT 13,066 Reputation points

2023-12-06T01:30:59.8033333+00:00

@Amit - Just checking in to see if the below answer helped. If this answers your query, do click "Accept as Answer" and click "Yes" for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

1 answer

Your answer

Monalla-MSFT 13,066 Reputation points

2023-12-06T01:30:59.8033333+00:00

@Amit - Just checking in to see if the below answer helped. If this answers your query, do click "Accept as Answer" and click "Yes" for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer 1

Luis Arias 8,616 Moderator

Hi Amit,

To forward Azure Firewall logs to a Syslog server , based on MS documentation is required:

Configure a Linux VM: The log forwarder.
Install a Syslog daemon and the Log Analytics agent on the VM
Create a data collection rule in Azure Monitor Agent: To specify what data to collect and where to send it
Configure the Syslog daemon and the Log Analytics agent to receive the log and sent to Syslog server.

Some examples;

Let me know if this help you, if you need deeper information also let me know to create my own lab and help you. (Very interesting topic)

Luis

Amit 0 Reputation points

2023-11-23T11:58:18.6666667+00:00

FYI- I have Syslog Server setup which is outside the Azure Environment.

I have the domain and port number.
For Example
Domain: abcd.com
PORT: 1234

I have to send the Firewall Azure logs to the above domain and port number.

Can you please explain more about this situation if I have a Syslog server outside the Azure Environment?

Many thanks for your previous suggestion.
Luis Arias 8,616 Reputation points Moderator

2023-11-24T23:48:00.5533333+00:00
Hi Amit,

Send Azure logs to an external syslog server will require an additional effor an some development effor There are 2 escenaries (Both require Enable firewall diagnostics:):

No real time require retrive logs(KQL) from azure monitor with an Azure Function / Logic App and sent to your On-premise syslog server. This azure function/ logic app need to format the logs in Syslog format

Real time require an Azure event hub to trigger an Azure Function / Logic App that have the code to formating and send to syslog onpremise server. Here is one example: (https://github.com/miguelangelopereira/azuremonitor2syslog)

Here I can share you some guidelines to configure the steps:

Enable firewall diagnostics (https://learn.microsoft.com/en-us/azure/firewall/firewall-diagnostics / https://learn.microsoft.com/en-us/azure/firewall/logs-and-metrics)

Create Azure function (https://learn.microsoft.com/en-us/azure/azure-functions/functions-create-function-app-portal)

Create Logic App (https://learn.microsoft.com/en-us/azure/logic-apps/create-single-tenant-workflows-azure-portal)

Query log with KQL (https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/)

Let me know if this information help you with your question.

Share via

Azure Firewall Log Forwarding Issue

1 answer

Your answer