|
| 1 | +--- |
| 2 | +title: Collect syslog with Azure Monitor Agent |
| 3 | +description: Configure collection of syslog logs using a data collection rule on virtual machines with the Azure Monitor Agent. |
| 4 | +ms.topic: conceptual |
| 5 | +ms.date: 05/10/2023 |
| 6 | +author: narinem |
| 7 | +ms.author: narinem |
| 8 | +ms.reviewer: glinuxagent |
| 9 | +--- |
| 10 | + |
| 11 | +# Collect syslog with Azure Monitor Agent overview |
| 12 | + |
| 13 | +Syslog is an event logging protocol that's common to Linux. You can use the Syslog daemon built into Linux devices and appliances to collect local events of the types you specify, and have it send those events to Microsoft Azure Monitor. Applications send messages that might be stored on the local machine or delivered to a Syslog collector. When the Azure Monitor agent for Linux is installed, it configures the local Syslog daemon to forward messages to the agent when syslog collection is enabled in [data collection rule (DCR)](../essentials/data-collection-rule-overview.md). The Azure Monitor Agent then sends the messages to Azure Monitor/Log Analytics workspace where a corresponding syslog record is created in [Syslog table](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/syslog). |
| 14 | + |
| 15 | + |
| 16 | + |
| 17 | + |
| 18 | + |
| 19 | +The following facilities are supported with the Syslog collector: |
| 20 | +* auth |
| 21 | +* authpriv |
| 22 | +* cron |
| 23 | +* daemon |
| 24 | +* mark |
| 25 | +* kern |
| 26 | +* lpr |
| 27 | +* mail |
| 28 | +* news |
| 29 | +* syslog |
| 30 | +* user |
| 31 | +* uucp |
| 32 | +* local0-local7 |
| 33 | + |
| 34 | +For some device types that don't allow local installation of the Azure Monitor agent, the agent can be installed instead on a dedicated Linux-based log forwarder. The originating device must be configured to send Syslog events to the Syslog daemon on this forwarder instead of the local daemon. Please see [Sentinel documents](https://learn.microsoft.com/en-us/azure/sentinel/connect-syslog#architecture) for more information. |
| 35 | + |
| 36 | +## Configure Syslog |
| 37 | + |
| 38 | +The Azure Monitor agent for Linux will only collect events with the facilities and severities that are specified in its configuration. You can configure Syslog through the Azure portal or by managing configuration files on your Linux agents. |
| 39 | + |
| 40 | +### Configure Syslog in the Azure portal |
| 41 | +Configure Syslog from the Data Collection Rules menu of the Azure Monitor. This configuration is delivered to the configuration file on each Linux agent. |
| 42 | +* Select Add data source. |
| 43 | +* For Data source type, select Linux syslog |
| 44 | + |
| 45 | +You can collect syslog events with different log level for each facility. By default, all syslog facility types will be collected. If you do not want to collect for example events of `auth` type, select `none` in the `Minimum log level` list box for `auth` facility and save the changes. If you need to change default log level for syslog events and collect only events with log level starting “NOTICE” or higher priority, select “LOG_NOTICE” in “Minimum log level” list box. |
| 46 | + |
| 47 | +By default, all configuration changes are automatically pushed to all agents that are configured in the DCR. |
| 48 | + |
| 49 | +### Create a data collection rule |
| 50 | + |
| 51 | +Create a *data collection rule* in the same region as your Log Analytics workspace. |
| 52 | +A data collection rule is an Azure resource that allows you to define the way data should be handled as it's ingested into the workspace. |
| 53 | + |
| 54 | +1. Sign in to the [Azure portal](https://portal.azure.com). |
| 55 | +1. Search for and open **Monitor**. |
| 56 | +1. Under **Settings**, select **Data Collection Rules**. |
| 57 | +1. Select **Create**. |
| 58 | + |
| 59 | + :::image type="content" source="../../sentinel/media/forward-syslog-monitor-agent/create-data-collection-rule.png" alt-text="Screenshot of the data collections rules pane with the create option selected."::: |
| 60 | + |
| 61 | + |
| 62 | +#### Add resources |
| 63 | +1. Select **Add resources**. |
| 64 | +1. Use the filters to find the virtual machine that you'll use to collect logs. |
| 65 | + :::image type="content" source="../../sentinel/media/forward-syslog-monitor-agent/create-rule-scope.png" alt-text="Screenshot of the page to select the scope for the data collection rule. "::: |
| 66 | +1. Select the virtual machine. |
| 67 | +1. Select **Apply**. |
| 68 | +1. Select **Next: Collect and deliver**. |
| 69 | + |
| 70 | +#### Add data source |
| 71 | + |
| 72 | +1. Select **Add data source**. |
| 73 | +1. For **Data source type**, select **Linux syslog**. |
| 74 | + :::image type="content" source="../../sentinel/media/forward-syslog-monitor-agent/create-rule-data-source.png" alt-text="Screenshot of page to select data source type and minimum log level"::: |
| 75 | +1. For **Minimum log level**, leave the default values **LOG_DEBUG**. |
| 76 | +1. Select **Next: Destination**. |
| 77 | + |
| 78 | +#### Add destination |
| 79 | + |
| 80 | +1. Select **Add destination**. |
| 81 | + |
| 82 | + :::image type="content" source="../../sentinel/media/forward-syslog-monitor-agent/create-rule-add-destination.png" alt-text="Screenshot of the destination tab with the add destination option selected."::: |
| 83 | +1. Enter the following values: |
| 84 | + |
| 85 | + |Field |Value | |
| 86 | + |---------|---------| |
| 87 | + |Destination type | Azure Monitor Logs | |
| 88 | + |Subscription | Select the appropriate subscription | |
| 89 | + |Account or namespace |Select the appropriate Log Analytics workspace| |
| 90 | + |
| 91 | +1. Select **Add data source**. |
| 92 | +1. Select **Next: Review + create**. |
| 93 | + |
| 94 | +## Configure Syslog on Linux Agent |
| 95 | +When the Azure Monitoring Agent is installed on Linux machine it installs a default Syslog configuration file that defines the facility and severity of the messages that are collected if syslog is enabled in DCR. The configuration file is different depending on the Syslog daemon that the client has installed. |
| 96 | + |
| 97 | +### Rsyslog |
| 98 | +On many Linux distributions, the rsyslogd daemon is responsible for consuming, storing, and routing log messages sent using the Linux syslog API. Azure Monitor agent uses the unix domain socket output module (omuxsock) in rsyslog to forward log messages to the Azure Monitor Agent. The AMA installation includes default config files that get placed under the following directory: |
| 99 | +`/etc/opt/microsoft/azuremonitoragent/syslog/rsyslogconf/05-azuremonitoragent-loadomuxsock.conf` |
| 100 | +`/etc/opt/microsoft/azuremonitoragent/syslog/rsyslogconf/05-azuremonitoragent-loadomuxsock.conf` |
| 101 | + |
| 102 | +When syslog is added to data collection rule, these configuration files will be installed under `etc/rsyslog.d` system directory and rsyslog will be automatically restarted for the changes to take effect. These files are used by rsyslog to load the output module and forward the events to Azure Monitoring agent daemon using defined rules. The builtin omuxsock module cannot be loaded more than once. Therefore, the configurations for loading of the module and forwarding of the events with corresponding forwarding format template are split in two different files. Its default contents are shown in the following example. This example collects Syslog messages sent from the local agent for all facilities with all log levels. |
| 103 | +``` |
| 104 | +$ cat /etc/rsyslog.d/10-azuremonitoragent.conf |
| 105 | +# Azure Monitor Agent configuration: forward logs to azuremonitoragent |
| 106 | +$OMUxSockSocket /run/azuremonitoragent/default_syslog.socket |
| 107 | +template(name="AMA_RSYSLOG_TraditionalForwardFormat" type="string" string="<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%") |
| 108 | +$OMUxSockDefaultTemplate AMA_RSYSLOG_TraditionalForwardFormat |
| 109 | +# Forwarding all events through Unix Domain Socket |
| 110 | +*.* :omuxsock: |
| 111 | +``` |
| 112 | + |
| 113 | +``` |
| 114 | +$ cat /etc/rsyslog.d/05-azuremonitoragent-loadomuxsock.conf |
| 115 | +# Azure Monitor Agent configuration: load rsyslog forwarding module. |
| 116 | +$ModLoad omuxsock |
| 117 | +``` |
| 118 | +Note that on some legacy systems such as CentOS 7.3 we have seen rsyslog log formatting issues when using traditional forwarding format to send syslog events to Azure Monitor Agent and for these systems, Azure Monitor Agent is automatically placing legacy forwarder template instead: |
| 119 | +`template(name="AMA_RSYSLOG_TraditionalForwardFormat" type="string" string="%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%\n")` |
| 120 | + |
| 121 | + |
| 122 | +### Syslog-ng |
| 123 | + |
| 124 | +The configuration file for syslog-ng is installed at `/etc/opt/microsoft/azuremonitoragent/syslog/syslog-ngconf/azuremonitoragent.conf`. When Syslog collection is added to data collection rule, this configuration file will be placed under `/etc/syslog-ng/conf.d/azuremonitoragent.conf` system directory and syslog-ng will be automatically restarted for the changes to take effect. Its default contents are shown in this example. This example collects Syslog messages sent from the local agent for all facilities and all severities. |
| 125 | +``` |
| 126 | +$ cat /etc/syslog-ng/conf.d/azuremonitoragent.conf |
| 127 | +# Azure MDSD configuration: syslog forwarding config for mdsd agent options {}; |
| 128 | +
|
| 129 | +# during install time, we detect if s_src exist, if it does then we |
| 130 | +
|
| 131 | +# replace it by appropriate source name like in redhat 's_sys' |
| 132 | +
|
| 133 | +# Forwrding using unix domain socket |
| 134 | +
|
| 135 | +destination d_azure_mdsd { |
| 136 | +
|
| 137 | +unix-dgram("/run/azuremonitoragent/default_syslog.socket" |
| 138 | +
|
| 139 | +flags(no_multi_line) |
| 140 | +
|
| 141 | +); |
| 142 | +}; |
| 143 | +
|
| 144 | +log { source(s_src); # will be automatically parsed from /etc/syslog-ng/syslog-ng.conf |
| 145 | +destination(d_azure_mdsd); }; |
| 146 | +``` |
| 147 | + |
| 148 | +Note* Azure Monitor supports collection of messages sent by rsyslog or syslog-ng, where rsyslog is the default daemon. The default Syslog daemon on version 5 of Red Hat Enterprise Linux, CentOS, and Oracle Linux version (sysklog) isn't supported for Syslog event collection. To collect Syslog data from this version of these distributions, the rsyslog daemon should be installed and configured to replace sysklog. |
| 149 | + |
| 150 | +Note* |
| 151 | +If you edit the Syslog configuration, you must restart the Syslog daemon for the changes to take effect. |
| 152 | + |
| 153 | + |
| 154 | + |
| 155 | +## Prerequisites |
| 156 | +You will need: |
| 157 | + |
| 158 | +- Log Analytics workspace where you have at least [contributor rights](../logs/manage-access.md#azure-rbac). |
| 159 | +- [Data collection endpoint](../essentials/data-collection-endpoint-overview.md#create-a-data-collection-endpoint). |
| 160 | +- [Permissions to create Data Collection Rule objects](../essentials/data-collection-rule-overview.md#permissions) in the workspace. |
| 161 | + |
| 162 | +## Syslog record properties |
| 163 | + |
| 164 | +Syslog records have a type of **Syslog** and have the properties shown in the following table. |
| 165 | + |
| 166 | +| Property | Description | |
| 167 | +|:--- |:--- | |
| 168 | +| Computer |Computer that the event was collected from. | |
| 169 | +| Facility |Defines the part of the system that generated the message. | |
| 170 | +| HostIP |IP address of the system sending the message. | |
| 171 | +| HostName |Name of the system sending the message. | |
| 172 | +| SeverityLevel |Severity level of the event. | |
| 173 | +| SyslogMessage |Text of the message. | |
| 174 | +| ProcessID |ID of the process that generated the message. | |
| 175 | +| EventTime |Date and time that the event was generated. | |
| 176 | + |
| 177 | +## Log queries with Syslog records |
| 178 | + |
| 179 | +The following table provides different examples of log queries that retrieve Syslog records. |
| 180 | + |
| 181 | +| Query | Description | |
| 182 | +|:--- |:--- | |
| 183 | +| Syslog |All Syslogs | |
| 184 | +| Syslog | where SeverityLevel == "error" |All Syslog records with severity of error | |
| 185 | +| Syslog | where Facility == "auth" |All Syslog records with auth facility type | |
| 186 | +| Syslog | summarize AggregatedValue = count() by Facility |Count of Syslog records by facility | |
| 187 | + |
| 188 | +## Next steps |
| 189 | + |
| 190 | +Learn more about: |
| 191 | + |
| 192 | +- [Azure Monitor Agent](azure-monitor-agent-overview.md). |
| 193 | +- [Data collection rules](../essentials/data-collection-rule-overview.md). |
| 194 | +- [Best practices for cost management in Azure Monitor](../best-practices-cost.md). |
0 commit comments