Syslog through AMA connector not showing in the content hub list.

Bl()e 5 Reputation points
2024-06-03T09:40:15.5033333+00:00

Hi,
Trying to set up a syslog ingestion into Sentinel for testing.
The setup consists of AMA on a on-prem syslog server.

The legacy agent is soon not supported, and the requirement of AMA on-prem is according to Microsoft guides to have the following prerequisites:

Azure-Arc enrollment -OK

Syslog data connector via AMA.

It seems that I can't find the correct connector for syslog via AMA. only the CEF version. In all guides that I'll have currently looked upon says that the connector should be in the content hub list.

Can anyone confirm this, or is it another way to do this now?

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,022 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. William Nieto 465 Reputation points
    2024-06-03T11:31:21.7866667+00:00

    Setting up syslog ingestion into Microsoft Sentinel using the Azure Monitor Agent (AMA) can be a bit tricky, especially with recent updates and the deprecation. Here’s a step-by-step outline of what you should do based on the latest guidelines:

    1. Azure Arc Enrollment

    You’re on the right track by ensuring that your on-premises syslog server is connected to Azure Arc. This step is crucial for managing and monitoring your resources across hybrid environments.

    1. Install and Configure the Azure Monitor Agent (AMA)

    Installing the Azure Monitor Agent (AMA) on your syslog server is essential. Here’s a more detailed breakdown of this step:

    • Installation:
      • Download the AMA installation script from here.
        • Execute the following commands on your Linux machine:
              wget https://aka.ms/InstallAMA.sh
        

    sudo bash InstallAMA.sh ```

      - **Configuration**:
      
         - Once installed, configure the AMA to collect syslog data.
         
            - Edit the **`ama.conf`** file to specify the syslog facilities and severities you want to collect.
            
               - Example configuration (adjust paths and settings as needed):
               
               ```python
               [syslog]
    

    enabled = ```

    1. Syslog Data Connector

    As you correctly pointed out, the dedicated Syslog data connector for AMA might not be directly available in the Content Hub. Instead, consider using the Common Event Format (CEF) data connector, which is widely supported and works well with syslog data.

    Additional Steps for CEF Connector:

    1. Create a Linux Virtual Machine (if needed):
      • If your syslog server isn’t already running Linux, set up a Linux VM where you can install the necessary agents.
      1. Install the AMA on the Linux VM:
        • Use the same installation commands as mentioned earlier.
        1. Configure the AMA for Syslog Collection:
          • Download the AMA configuration script specific to syslog.
            • Adjust the configuration settings to match your environment.

    Install the Syslog or CEF Data Connector in Sentinel:

    1. Navigate to Microsoft Sentinel in the Azure portal.
    2. Select Data Connectors from the Configuration section.
    3. Find and select the CEF connector:
      • Follow the provided steps to set it up.
        • This typically involves installing the required agent on the machine that will send CEF logs.
          • Configure your syslog server to forward logs in CEF format to the agent.

    Tips:

    • Verify Configuration:
      • Ensure that your syslog server forwards logs correctly.
        • Check that the AMA is properly receiving these logs.
    • Logs:
      • Examine the logs on your syslog server and the machine running AMA for any errors or misconfigurations.
      • Permissions:
        • Confirm that the user running the AMA has the necessary permissions to access the syslog files and send data to Azure Monitor.

    Remember to consult the official Microsoft documentation for the most up-to-date instructions and detailed guidance.

    Ingest Syslog and CEF messages to Microsoft Sentinel with the Azure Monitor Agent

    Deploy a log forwarder to ingest Syslog and CEF logs to Microsoft Sentinel

    Collect data from Linux-based sources using Syslog

    By following these steps, you’ll successfully set up syslog ingestion into Microsoft Sentinel using AMA. If the dedicated syslog connector for AMA isn’t available yet, relying on the CEF connector is a reliable alternative. 

    0 comments No comments

  2. Bl()e 5 Reputation points
    2024-06-04T14:16:34.34+00:00

    Hi,

    I have now installed CEF via AMA in sentinel, and configured a DCR that collects from the arc-enabled syslog server.

    I have also configured a device that shall send logs towards the syslog server, and confirmed it sending logs using tcpdump.

    Hearbeat of agent: OK, verified in LA

    However, it will not forward the actual logs from the devices.

    I'll get this message in AMA after trying different install scripts that changed the configuration:

    I can't verify Syslog in LA.

    2024-06-04T11:22:53.3910500Z: [/__w/1/s/external/WindowsAgent/src/shared/mcsmanager/lib/src/Configuration.cpp:410,ParseDataSources]Data source syslog is not implemented ErrorCode:-2146171897

    2024-06-04T11:22:53.4435500Z: [/__w/1/s/external/WindowsAgent/src/shared/mcsmanager/lib/src/Configuration.cpp:410,ParseDataSources]Data source syslog is not implemented ErrorCode:-2146171897

    2024-06-04T11:22:53.4435940Z: [/__w/1/s/external/WindowsAgent/src/shared/mcsmanager/lib/src/Configuration.cpp:410,ParseDataSources]Data source syslog is not implemented ErrorCode:-2146171897

    2024-06-04T13:18:08.4699950Z: [/__w/1/s/external/WindowsAgent/src/shared/mcsmanager/lib/src/Configuration.cpp:410,ParseDataSources]Data source syslog is not implemented ErrorCode:-2146171897

    Any advice?