Tutorial: Forward Syslog data to a Log Analytics workspace with Microsoft Sentinel by using Azure Monitor Agent

In this tutorial, you configure a Linux virtual machine (VM) to forward Syslog data to your workspace by using Azure Monitor Agent. These steps allow you to collect and monitor data from Linux-based devices where you can't install an agent like a firewall network device.

Configure your Linux-based device to send data to a Linux VM. Azure Monitor Agent on the VM forwards the Syslog data to the Log Analytics workspace. Then use Microsoft Sentinel or Azure Monitor to monitor the device from the data stored in the Log Analytics workspace.

In this tutorial, you learn how to:

Prerequisites

To complete the steps in this tutorial, you must have the following resources and roles:

• An Azure account with an active subscription. Create an account for free.

• An Azure account with the following roles to deploy the agent and create the data collection rules.

  Built-in role	Scope	Reason
  - Virtual Machine Contributor - Azure Connected Machine Resource Administrator	- Virtual machines - Scale sets - Azure Arc-enabled servers	To deploy the agent
  Any role that includes the action Microsoft.Resources/deployments/*	- Subscription - Resource group - Existing data collection rule	To deploy Azure Resource Manager templates
  Monitoring Contributor	- Subscription - Resource group - Existing data collection rule	To create or edit data collection rules

• A Log Analytics workspace.

• A Linux server that's running an operating system that supports Azure Monitor Agent.

  • Supported Linux operating systems for Azure Monitor Agent.
  • Create a Linux VM in the Azure portal or add an on-premises Linux server to Azure Arc.

• A Linux-based device that generates event log data like a firewall network device.

Configure Syslog data source

Create the DCR using the process in Collect data from virtual machine client with Azure Monitor. On the Collect and deliver tab of the DCR, select Linux Syslog from the Data source type dropdown.

Select a Minimum log level for each facility or NONE to collect no events for that facility. You can configure multiple facilities at once by selecting their checkbox and then selecting a log level in Set minimum log level for selected facilities.

All logs with the selected severity level and higher are collected for the facility. The supported severity levels and their relative severity are as follows:

1. Debug
2. Info
3. Notice
4. Warning
5. Error
6. Critical
7. Alert
8. Emergency

Add destinations

Syslog data can only be sent to a Log Analytics workspace where it's stored in the Syslog table. Add a destination of type Azure Monitor Logs and select a Log Analytics workspace. While you can add multiple workspaces, be aware that this will send duplicate data to each which will result in additional cost.

Verify data collection

To verify that data is being collected, check for records in the Syslog table. From the virtual machine or from the Log Analytics workspace in the Azure portal, select Logs and then click the Tables button. Under the Virtual machines category, click Run next to Syslog.

For the full procedure of configuring Syslog data collection, see Collect Syslog events with Azure Monitor Agent.

Verify that Azure Monitor Agent is running

In Microsoft Sentinel or Azure Monitor, verify that Azure Monitor Agent is running on your VM.

1. In the Azure portal, search for and open Microsoft Sentinel or Azure Monitor.

2. If you're using Microsoft Sentinel, select the appropriate workspace.

3. Under General, select Logs.

4. Close the Queries page so that the New Query tab appears.

5. Run the following query where you replace the computer value with the name of your Linux VM.

   Heartbeat
   | where Computer == "vm-linux"
   | take 10
   

Enable log reception on port 514

Verify that the VM that's collecting the log data allows reception on port 514 TCP or UDP depending on the Syslog source. Then configure the built-in Linux Syslog daemon on the VM to listen for Syslog messages from your devices. After you finish those steps, configure your Linux-based device to send logs to your VM.

The following two sections cover how to add an inbound port rule for an Azure VM and configure the built-in Linux Syslog daemon.

Allow inbound Syslog traffic on the VM

If you're forwarding Syslog data to an Azure VM, follow these steps to allow reception on port 514.

1. In the Azure portal, search for and select Virtual Machines.

2. Select the VM.

3. Under Settings, select Networking.

4. Select Add inbound port rule.

5. Enter the following values.

   Field	Value
   Destination port ranges	514
   Protocol	TCP or UDP depending on Syslog source
   Action	Allow
   Name	AllowSyslogInbound

   Use the default values for the rest of the fields.

6. Select Add.

Configure the Linux Syslog daemon

Connect to your Linux VM and configure the Linux Syslog daemon. For example, run the following command, adapting the command as needed for your network environment:

sudo wget -O Forwarder_AMA_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Forwarder_AMA_installer.py&&sudo python3 Forwarder_AMA_installer.py

This script can make changes for both rsyslog.d and syslog-ng.

Verify Syslog data is forwarded to your Log Analytics workspace

After you configure your Linux-based device to send logs to your VM, verify that Azure Monitor Agent is forwarding Syslog data to your workspace.

1. In the Azure portal, search for and open Microsoft Sentinel or Azure Monitor.

2. If you're using Microsoft Sentinel, select the appropriate workspace.

3. Under General, select Logs.

4. Close the Queries page so that the New Query tab appears.

5. Run the following query where you replace the computer value with the name of your Linux VM.

   Syslog
   | where Computer == "vm-linux"
   | summarize by HostName
   

Clean up resources

Evaluate whether you need the resources like the VM that you created. Resources you leave running can cost you money. Delete the resources you don't need individually. You can also delete the resource group to delete all the resources you created.

Related content

• Data collection rules in Azure Monitor
• Collect Syslog events with Azure Monitor Agent