Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,645 questions
Send syslog server logs to Azure Sentinel through log analytics gateway
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(6.4, 10%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPK%3C/text%3E%3C/svg%3E)
pavan kemisetti
1
Reputation point
Team, I have a scenario where one of our customer wanted to send the syslog data to Sentinel through log analytics gateway. We tried to simulate this on our lab but we were facing issues with the successful installation. Can we have a steps where we can follow to suceed with this approach.
Azure Monitor
Microsoft Security Microsoft Sentinel
1,299 questions
{count} votes
-
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator2020-12-11T00:02:54.103+00:00 @pavan kemisetti
Thank you for your post! I looked into your issue and found some links that might help.Azure Sentinel Documentation - Collect data from Linux-based sources using Syslog
Azure Monitor Documentation - Collect Syslog data sources with Log Analytics agentIf you have any other questions, please let me know.
Thank you for your time and patience throughout this issue. -
pavan kemisetti 1 Reputation point
2020-12-11T12:47:44.617+00:00 HI James,
Thanks for the response. We have a linux machine which does not connect to the internet and we have configured log analytics gateway to send the logs to sentinel from the linux machine. We have configured log analytics gateway as a proxy.
Point here is we are able to get the syslog from the machine but unable to configure the CEF connector to get the CEF logs
Unable to modify the rsyslog.d configurations. We have used the manual download of the OMS agent rather than the script which connect to the internet to get all the required configurations. -
pavan kemisetti 1 Reputation point
2020-12-11T13:15:45.147+00:00 Cannit access the path below though i am a root user and says permission denied. owner of the file is omsagent
/etc/opt/microsoft/omsagent/{0}/conf/omsagent.d/security_events.conf
-
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator
2020-12-12T00:39:23.843+00:00 @pavan kemisetti
Thank you for the quick and detailed response! Based off your issue, I believe this might be best addressed by our support team through an Azure support request. However, I've added the "azure-monitor" tag to this thread so our Log Analytics team can take a look at this issue as well.If you have any other questions or if you'd like to work with our Support Engineers on this issue, please let me know.
Thank you for your time and patience throughout this issue.
Sign in to comment
Sign in to answer