This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Experience with UTM Syslog Message in Azure OMS Log Analytics?

Hi,

I have a lot to do with Azure and I'd like to write the syslog of my UTM at home in my private OMS Log Analytics. (https://azure.microsoft.com/en-us/services/log-analytics/)

I'm a little surprised that I have not found any information on the Internet and no one else came up with the idea.

I entered a remote syslog server in my UTM and installed the OMS agent on this server. All syslog events of the UTM will be uploaded, but not formatted properly (everything is in the field "SyslogMessage". e.g:

Currently I'm playing around with the "Custom Fields" in OMS, to format these properly. But it does not want it the way I want :D

Has anyone ever tried to load the UTM logs into the Azure and maybe even built dashboards for this?

Before the question arises, why: I know iview, but I would like to play around with OMS Loganalytics

Regards
Tobias

This thread was automatically locked due to age.

MehmetS over 6 years ago

Hello there,

How did you direct the logs to Azure's side?

Can you give me information about this ?

I will try to create a visual portal

Greetings.
Cancel
Vote Up 0 Vote Down

Cancel
logan517 over 6 years ago in reply to MehmetS
Hi,

that was easier than I initially thought.

You need an extra linux server.

Install the oms agent on this linux server and and set this in the utm as syslog server.

After this, you have to configure the oms agent, to send all data to azure (https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-data-sources-syslog)

Waiting time ;) - best 1 day

Finally, the custom fields have to be configured (https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-custom-fields)

Waiting time ;) - best 7 days, because then the maximum number of data are available in the free licensing

Create your dashboards

I had to change my system - I do not use the utm anymore - cause the max 50 ip licencing limit.
Unfortunately, I can not send you a screenshot anymore, as I have never really done that with the Dashboard, I simply did not have the time to deal with it and now I do not need it anymore

I hope I could help you, if you have any questions, just let me know
Cancel
Vote Up 0 Vote Down

Cancel