Skip to content

Commit 595b4d6

Browse files
paulth1paulth1
committed
edit pass: five-articles-for-agents
1 parent 880b9e9 commit 595b4d6

File tree

3 files changed

+103
-89
lines changed

3 files changed

+103
-89
lines changed

‎articles/azure-monitor/agents/data-collection-rule-azure-monitor-agent.md

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: Monitor data from virtual machines with the Azure Monitor agent
3-
description: Describes how to collect events and performance data from virtual machines by using the Azure Monitor agent.
2+
title: Monitor data from virtual machines with Azure Monitor Agent
3+
description: Describes how to collect events and performance data from virtual machines by using Azure Monitor Agent.
44
ms.topic: conceptual
55
ms.date: 06/23/2022
66
author: guywild
@@ -9,13 +9,13 @@ ms.reviewer: shseth
99

1010
---
1111

12-
# Collect data from virtual machines with the Azure Monitor agent
12+
# Collect data from virtual machines with Azure Monitor Agent
1313

14-
This article describes how to collect events and performance counters from virtual machines by using the Azure Monitor agent.
14+
This article describes how to collect events and performance counters from virtual machines by using Azure Monitor Agent.
1515

16-
To collect data from virtual machines by using the Azure Monitor agent, you'll:
16+
To collect data from virtual machines by using Azure Monitor Agent, you'll:
1717

18-
1. Create [data collection rules (DCRs)](../essentials/data-collection-rule-overview.md) that define which data the Azure Monitor agent sends to which destinations.
18+
1. Create [data collection rules (DCRs)](../essentials/data-collection-rule-overview.md) that define which data Azure Monitor Agent sends to which destinations.
1919
1. Associate the data collection rule to specific virtual machines.
2020

2121
You can associate virtual machines to multiple data collection rules. For this reason, you can define each data collection rule to address a particular requirement. You can associate the data collection rules to virtual machines based on the specific data you want to collect from each machine.
@@ -39,7 +39,7 @@ To send data to Log Analytics, create the data collection rule in the *same regi
3939

4040
[ ![Screenshot that shows the Basics tab of the Data Collection Rule screen.](media/data-collection-rule-azure-monitor-agent/data-collection-rule-basics-updated.png) ](media/data-collection-rule-azure-monitor-agent/data-collection-rule-basics-updated.png#lightbox)
4141

42-
1. On the **Resources** tab, add the resources to which to associate the data collection rule. Resources can be virtual machines, virtual machine scale sets, and Azure Arc for servers. The Azure portal installs the Azure Monitor agent on resources that don't already have it installed. The portal also enables Azure Managed Identity.
42+
1. On the **Resources** tab, add the resources to which to associate the data collection rule. Resources can be virtual machines, virtual machine scale sets, and Azure Arc for servers. The Azure portal installs Azure Monitor Agent on resources that don't already have it installed. The portal also enables Azure Managed Identity.
4343

4444
> [!IMPORTANT]
4545
> The portal enables system-assigned managed identity on the target resources, along with existing user-assigned identities, if there are any. For existing applications, unless you specify the user-assigned identity in the request, the machine defaults to using system-assigned identity instead.
@@ -147,6 +147,6 @@ Examples of filtering events that use a custom XPath:
147147
148148
## Next steps
149149
150-
- [Collect text logs by using the Azure Monitor agent](data-collection-text-log.md).
151-
- Learn more about the [Azure Monitor agent](azure-monitor-agent-overview.md).
150+
- [Collect text logs by using Azure Monitor Agent](data-collection-text-log.md).
151+
- Learn more about [Azure Monitor Agent](azure-monitor-agent-overview.md).
152152
- Learn more about [data collection rules](../essentials/data-collection-rule-overview.md).

‎articles/azure-monitor/agents/data-sources-syslog.md

Lines changed: 42 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,22 @@
11
---
2-
title: Collect Syslog data sources with Log Analytics agent in Azure Monitor
3-
description: Syslog is an event logging protocol that is common to Linux. This article describes how to configure collection of Syslog messages in Log Analytics and details of the records they create.
2+
title: Collect Syslog data sources with the Log Analytics agent in Azure Monitor
3+
description: Syslog is an event logging protocol that's common to Linux. This article describes how to configure collection of Syslog messages in Log Analytics and details the records they create.
44
ms.topic: conceptual
55
ms.date: 04/06/2022
66
ms.reviewer: luki
77

88
---
99

10-
# Collect Syslog data sources with Log Analytics agent
11-
Syslog is an event logging protocol that is common to Linux. Applications will send messages that may be stored on the local machine or delivered to a Syslog collector. When the Log Analytics agent for Linux is installed, it configures the local Syslog daemon to forward messages to the agent. The agent then sends the message to Azure Monitor where a corresponding record is created.
10+
# Collect Syslog data sources with the Log Analytics agent
1211

13-
[!INCLUDE [Log Analytics agent deprecation](../../../includes/log-analytics-agent-deprecation.md)]
12+
Syslog is an event logging protocol that's common to Linux. Applications send messages that might be stored on the local machine or delivered to a Syslog collector. When the Log Analytics agent for Linux is installed, it configures the local Syslog daemon to forward messages to the agent. The agent then sends the messages to Azure Monitor where a corresponding record is created.
1413

14+
[!INCLUDE [Log Analytics agent deprecation](../../../includes/log-analytics-agent-deprecation.md)]
1515

1616
> [!NOTE]
17-
> Azure Monitor supports collection of messages sent by rsyslog or syslog-ng, where rsyslog is the default daemon. The default syslog daemon on version 5 of Red Hat Enterprise Linux, CentOS, and Oracle Linux version (sysklog) is not supported for syslog event collection. To collect syslog data from this version of these distributions, the [rsyslog daemon](http://rsyslog.com) should be installed and configured to replace sysklog.
17+
> Azure Monitor supports collection of messages sent by rsyslog or syslog-ng, where rsyslog is the default daemon. The default Syslog daemon on version 5 of Red Hat Enterprise Linux, CentOS, and Oracle Linux version (sysklog) isn't supported for Syslog event collection. To collect Syslog data from this version of these distributions, the [rsyslog daemon](http://rsyslog.com) should be installed and configured to replace sysklog.
1818
19-
20-
![Syslog collection](media/data-sources-syslog/overview.png)
19+
![Diagram that shows Syslog collection.](media/data-sources-syslog/overview.png)
2120

2221
The following facilities are supported with the Syslog collector:
2322

@@ -36,29 +35,33 @@ The following facilities are supported with the Syslog collector:
3635
* local0-local7
3736

3837
For any other facility, [configure a Custom Logs data source](data-sources-custom-logs.md) in Azure Monitor.
39-
40-
## Configuring Syslog
38+
39+
## Configure Syslog
40+
4141
The Log Analytics agent for Linux will only collect events with the facilities and severities that are specified in its configuration. You can configure Syslog through the Azure portal or by managing configuration files on your Linux agents.
4242

4343
### Configure Syslog in the Azure portal
44+
4445
Configure Syslog from the [Agent configuration menu](../agents/agent-data-sources.md#configuring-data-sources) for the Log Analytics workspace. This configuration is delivered to the configuration file on each Linux agent.
4546

46-
You can add a new facility by clicking **Add facility**. For each facility, only messages with the selected severities will be collected. Check the severities for the particular facility that you want to collect. You cannot provide any additional criteria to filter messages.
47+
You can add a new facility by selecting **Add facility**. For each facility, only messages with the selected severities will be collected. Select the severities for the particular facility that you want to collect. You can't provide any other criteria to filter messages.
48+
49+
[![Screenshot that shows configuring Syslog.](media/data-sources-syslog/configure.png)](media/data-sources-syslog/configure.png#lightbox)
4750

48-
[![Configure Syslog](media/data-sources-syslog/configure.png)](media/data-sources-syslog/configure.png#lightbox)
51+
By default, all configuration changes are automatically pushed to all agents. If you want to configure Syslog manually on each Linux agent, clear the **Apply below configuration to my machines** checkbox.
4952

50-
By default, all configuration changes are automatically pushed to all agents. If you want to configure Syslog manually on each Linux agent, then uncheck the box *Apply below configuration to my machines*.
53+
### Configure Syslog on the Linux agent
5154

52-
### Configure Syslog on Linux agent
53-
When the [Log Analytics agent is installed on a Linux client](../vm/monitor-virtual-machine.md), it installs a default syslog configuration file that defines the facility and severity of the messages that are collected. You can modify this file to change the configuration. The configuration file is different depending on the Syslog daemon that the client has installed.
55+
When the [Log Analytics agent is installed on a Linux client](../vm/monitor-virtual-machine.md), it installs a default Syslog configuration file that defines the facility and severity of the messages that are collected. You can modify this file to change the configuration. The configuration file is different depending on the Syslog daemon that the client has installed.
5456

5557
> [!NOTE]
56-
> If you edit the syslog configuration, you must restart the syslog daemon for the changes to take effect.
58+
> If you edit the Syslog configuration, you must restart the Syslog daemon for the changes to take effect.
5759
>
5860
>
5961
6062
#### rsyslog
61-
The configuration file for rsyslog is located at **/etc/rsyslog.d/95-omsagent.conf**. Its default contents are shown below. This collects syslog messages sent from the local agent for all facilities with a level of warning or higher.
63+
64+
The configuration file for rsyslog is located at `/etc/rsyslog.d/95-omsagent.conf`. Its default contents are shown in the following example. This example collects Syslog messages sent from the local agent for all facilities with a level of warning or higher.
6265

6366
```config
6467
kern.warning @127.0.0.1:25224
@@ -80,14 +83,15 @@ local6.warning @127.0.0.1:25224
8083
local7.warning @127.0.0.1:25224
8184
```
8285

83-
You can remove a facility by removing its section of the configuration file. You can limit the severities that are collected for a particular facility by modifying that facility's entry. For example, to limit the user facility to messages with a severity of error or higher you would modify that line of the configuration file to the following:
86+
You can remove a facility by removing its section of the configuration file. You can limit the severities that are collected for a particular facility by modifying that facility's entry. For example, to limit the user facility to messages with a severity of error or higher, you would modify that line of the configuration file to the following example:
8487

8588
```config
8689
user.error @127.0.0.1:25224
8790
```
8891

8992
#### syslog-ng
90-
The configuration file for syslog-ng is location at **/etc/syslog-ng/syslog-ng.conf**. Its default contents are shown below. This collects syslog messages sent from the local agent for all facilities and all severities.
93+
94+
The configuration file for syslog-ng is located at `/etc/syslog-ng/syslog-ng.conf`. Its default contents are shown in this example. This example collects Syslog messages sent from the local agent for all facilities and all severities.
9195

9296
```config
9397
#
@@ -140,23 +144,24 @@ filter f_user_oms { level(alert,crit,debug,emerg,err,info,notice,warning) and fa
140144
log { source(src); filter(f_user_oms); destination(d_oms); };
141145
```
142146

143-
You can remove a facility by removing its section of the configuration file. You can limit the severities that are collected for a particular facility by removing them from its list. For example, to limit the user facility to just alert and critical messages, you would modify that section of the configuration file to the following:
147+
You can remove a facility by removing its section of the configuration file. You can limit the severities that are collected for a particular facility by removing them from its list. For example, to limit the user facility to alert only critical messages, you would modify that section of the configuration file as shown in the following example:
144148

145149
```config
146150
#OMS_facility = user
147151
filter f_user_oms { level(alert,crit) and facility(user); };
148152
log { source(src); filter(f_user_oms); destination(d_oms); };
149153
```
150154

151-
### Collecting data from additional Syslog ports
152-
The Log Analytics agent listens for Syslog messages on the local client on port 25224. When the agent is installed, a default syslog configuration is applied and found in the following location:
155+
### Collect data from other Syslog ports
156+
157+
The Log Analytics agent listens for Syslog messages on the local client on port 25224. When the agent is installed, a default Syslog configuration is applied and found in the following location:
153158

154159
* Rsyslog: `/etc/rsyslog.d/95-omsagent.conf`
155160
* Syslog-ng: `/etc/syslog-ng/syslog-ng.conf`
156161

157-
You can change the port number by creating two configuration files: a FluentD config file and a rsyslog-or-syslog-ng file depending on the Syslog daemon you have installed.
162+
You can change the port number by creating two configuration files: a FluentD config file and a rsyslog-or-syslog-ng file depending on the Syslog daemon you have installed.
158163

159-
* The FluentD config file should be a new file located in: `/etc/opt/microsoft/omsagent/conf/omsagent.d` and replace the value in the **port** entry with your custom port number.
164+
* The FluentD config file should be a new file located in `/etc/opt/microsoft/omsagent/conf/omsagent.d` and replace the value in the `port` entry with your custom port number.
160165

161166
```xml
162167
<source>
@@ -170,7 +175,7 @@ You can change the port number by creating two configuration files: a FluentD co
170175
type filter_syslog
171176
```
172177

173-
* For rsyslog, you should create a new configuration file located in: `/etc/rsyslog.d/` and replace the value %SYSLOG_PORT% with your custom port number.
178+
* For rsyslog, you should create a new configuration file located in `/etc/rsyslog.d/` and replace the value `%SYSLOG_PORT%` with your custom port number.
174179

175180
> [!NOTE]
176181
> If you modify this value in the configuration file `95-omsagent.conf`, it will be overwritten when the agent applies a default configuration.
@@ -184,10 +189,10 @@ You can change the port number by creating two configuration files: a FluentD co
184189
auth.warning @127.0.0.1:%SYSLOG_PORT%
185190
```
186191

187-
* The syslog-ng config should be modified by copying the example configuration shown below and adding the custom modified settings to the end of the syslog-ng.conf configuration file located in `/etc/syslog-ng/`. Do **not** use the default label **%WORKSPACE_ID%_oms** or **%WORKSPACE_ID_OMS**, define a custom label to help distinguish your changes.
192+
* The syslog-ng config should be modified by copying the example configuration shown next and adding the custom modified settings to the end of the `syslog-ng.conf` configuration file located in `/etc/syslog-ng/`. Do *not* use the default label `%WORKSPACE_ID%_oms` or `%WORKSPACE_ID_OMS`. Define a custom label to help distinguish your changes.
188193

189194
> [!NOTE]
190-
> If you modify the default values in the configuration file, they will be overwritten when the agent applies a default configuration.
195+
> If you modify the default values in the configuration file, they'll be overwritten when the agent applies a default configuration.
191196
>
192197

193198
```config
@@ -196,10 +201,11 @@ You can change the port number by creating two configuration files: a FluentD co
196201
log { source(s_src); filter(f_custom_filter); destination(d_custom_dest); };
197202
```
198203

199-
After completing the changes, the Syslog and the Log Analytics agent service needs to be restarted to ensure the configuration changes take effect.
204+
After you finish the changes, restart the Syslog and the Log Analytics agent service to ensure the configuration changes take effect.
200205

201206
## Syslog record properties
202-
Syslog records have a type of **Syslog** and have the properties in the following table.
207+
208+
Syslog records have a type of **Syslog** and have the properties shown in the following table.
203209

204210
| Property | Description |
205211
|:--- |:--- |
@@ -213,16 +219,18 @@ Syslog records have a type of **Syslog** and have the properties in the followin
213219
| EventTime |Date and time that the event was generated. |
214220

215221
## Log queries with Syslog records
222+
216223
The following table provides different examples of log queries that retrieve Syslog records.
217224

218225
| Query | Description |
219226
|:--- |:--- |
220-
| Syslog |All Syslogs. |
221-
| Syslog &#124; where SeverityLevel == "error" |All Syslog records with severity of error. |
222-
| Syslog &#124; summarize AggregatedValue = count() by Computer |Count of Syslog records by computer. |
223-
| Syslog &#124; summarize AggregatedValue = count() by Facility |Count of Syslog records by facility. |
227+
| Syslog |All Syslogs |
228+
| Syslog &#124; where SeverityLevel == "error" |All Syslog records with severity of error |
229+
| Syslog &#124; summarize AggregatedValue = count() by Computer |Count of Syslog records by computer |
230+
| Syslog &#124; summarize AggregatedValue = count() by Facility |Count of Syslog records by facility |
224231

225232
## Next steps
233+
226234
* Learn about [log queries](../logs/log-query-overview.md) to analyze the data collected from data sources and solutions.
227-
* Use [Custom Fields](../logs/custom-fields.md) to parse data from syslog records into individual fields.
235+
* Use [custom fields](../logs/custom-fields.md) to parse data from Syslog records into individual fields.
228236
* [Configure Linux agents](../vm/monitor-virtual-machine.md) to collect other types of data.

0 commit comments

Comments
 (0)