How to select multiple log levels in a data collection rule for Linux syslog facilities ?

$@chin 115

Checking the possibility of selecting multiple min log levels for Linux syslog under a data collection rule for each facilities ?

User's image

In legacy log management systems, there is an option to select multiple min log level categories for the facility available under the Log Analytics workspace. Since this option is deprecating end of august 2024 and migrated to AMA.

should I create multiple data collection rules based on the number of min log levels for each facility ?

Rahul Podila 105 Reputation points Microsoft Vendor

2024-09-23T12:13:38.6333333+00:00
Hi @$@chin
Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

List the types of logs to monitor (e.g., auth, daemon, user).

Determine the minimum log levels needed for each (e.g., info, warn, error).

Set up a new rule in AMA for each type and log level.

Rule 1: Track auth logs at info.

Rule 2: Track auth logs at warn.

Rule 3: Track daemon logs at warn.

Rule 4: Track user logs at error.

Use the Azure portal to set up the rules easily.

After setup, verify that you're receiving the correct logs.

Keep a record of each rule and its purpose for future reference.

You’ll capture all the logs you need.

Modifying the rules will be straightforward if your requirements change.

You can easily adjust to any new logging needs that arise.

If you have any further quires, do let us know

If the answer is helpful, please click "Accept Answer" and "Upvote it".
Rahul Podila 105 Reputation points Microsoft Vendor

2024-09-25T06:22:31.9766667+00:00

Hi @$@chin If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!
Rahul Podila 105 Reputation points Microsoft Vendor

2024-09-27T06:53:45.98+00:00

Hi @$@chin
If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!
$@chin 115 Reputation points

2024-09-29T16:14:15.4+00:00

That means I have to create multiple data collection rules. that’s the only option. I need to create 10-15 data collection rules to collect these logs. The legacy feature is better in terms of this functionality because it allows us to choose a specific option, which varies based on individual requirements. Nevertheless, I hope Microsoft will release an feature update that allows multiple options within a single rule.

Share via

How to select multiple log levels in a data collection rule for Linux syslog facilities ?

Your answer