Hi @Leif Davisson ,
If I understood correctly your scenario, there are few things to clarify here:
The Log Analytics (OMS) Gateway is intended to act as a proxy when you want to connect Log Analytics Agents running on VMs without internet access to a Log Analytics Workspace (it cannot be used as a Syslog Forwarder):
Now, you have a Syslog source where you cannot install the Log Analytics (or Azure Monitor) Agent.
For you to be able to get that Syslog data in Sentinel, you need to use what is called a Syslog Forwarder.
The process is the following:
- Install a Linux Log Analytics Agent on a Linux VM and ensure is connected to the Sentinel Workspace (directly or through a Log Analytics Gateway if the VM is not having internet access)
- Configure the Syslog Collection from the Log Analytics Workspace (from Legacy Agents Management --> Syslog)
- Configure your Syslog Source (your ARM IOT device) to forward the Syslog data to the Linux Forwarder you configured at step 1 on the facility you configured to be collected at step 2
These instructions are also presented here.
I hope that this is the info you're looking for.