The Azure Monitor agent for Linux will only collect events with the facilities and severities that are specified in its configuration. Please see Sentinel tutorial for more information. The originating device must be configured to send Syslog events to the Syslog daemon on this forwarder instead of the local daemon. The following facilities are supported with the Syslog collector:įor some device types that don't allow local installation of the Azure Monitor agent, the agent can be installed instead on a dedicated Linux-based log forwarder. The Azure Monitor Agent then sends the messages to Azure Monitor/Log Analytics workspace where a corresponding syslog record is created in Syslog table. When the Azure Monitor agent for Linux is installed, it configures the local Syslog daemon to forward messages to the agent when syslog collection is enabled in data collection rule (DCR). Applications send messages that might be stored on the local machine or delivered to a Syslog collector. You can use the Syslog daemon built into Linux devices and appliances to collect local events of the types you specify, and have it send those events to Log Analytics Workspace.
Syslog is an event logging protocol that's common to Linux.
0 kommentar(er)
