Forwarding SYSLOG through a OMS Data Gateway

Question

I have an ARM IOT device that has about 64Gb of storage and can't support a OMS agent. I have setup a OMS Data Gateway on windows 10 and pointed the SYSLOG to the windows box. Confirmed its sending SYSLOG but OMSDG isn't picking it up and forwarding it to Sentinel. The OMS Gateway looks pretty simple and I have confirmed that the IOT device is sending SYSLOG. I am getting heartbeats from the OMS agent on windows. Where am I screwing up?

Answer 1

Hi @LeifDavisson ,

If I understood correctly your scenario, there are few things to clarify here:

The Log Analytics (OMS) Gateway is intended to act as a proxy when you want to connect Log Analytics Agents running on VMs without internet access to a Log Analytics Workspace (it cannot be used as a Syslog Forwarder):

Now, you have a Syslog source where you cannot install the Log Analytics (or Azure Monitor) Agent.
For you to be able to get that Syslog data in Sentinel, you need to use what is called a Syslog Forwarder.

The process is the following:

1. Install a Linux Log Analytics Agent on a Linux VM and ensure is connected to the Sentinel Workspace (directly or through a Log Analytics Gateway if the VM is not having internet access)
2. Configure the Syslog Collection from the Log Analytics Workspace (from Legacy Agents Management --> Syslog)
   
3. Configure your Syslog Source (your ARM IOT device) to forward the Syslog data to the Linux Forwarder you configured at step 1 on the facility you configured to be collected at step 2

These instructions are also presented here.

I hope that this is the info you're looking for.

BR,
George

Answer 2

Glad it worked out Leif.
I'm replying here so anyone interested knows your question was answered.
If you need more tips on setting up and troubleshooting the syslog configuration I have my own notes I'm happy to share.
I also have a few notes on configuring TLS syslog for things like Palo Alto.
Good Luck!