Syslog Forwarding to Microsoft Sentinel

Our earlier troubleshooting guide covered the checklist — port checks, firewall rules, AMA heartbeat. This post goes one level deeper: what the Syslog via AMA connector actually configures on the box, why the internal port is 28330 and not 514, and how to prove data is flowing at each hop instead of guessing.

The Syslog via AMA connector creates a DCR with a Linux Syslog data source. In the Collect tab you set a minimum log level per facility — selecting a level collects that level and everything more severe.

So selecting LOG_ERR for a facility collects Error, Critical, Alert, and Emergency — not Debug, Info, Notice, or Warning. This is the single most common cause of "my logs aren't showing up" that isn't actually a connectivity problem — the facility was set to NONE, or the minimum severity was set too high for the events you're trying to capture.

When Syslog is added to a DCR and AMA installs, it drops a config file that does the local forwarding. On rsyslog-based systems:

# Azure Monitor Agent configuration: forward logs to azuremonitoragent
template(name="AMA_RSYSLOG_TraditionalForwardFormat" type="string" string="<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%")
*.* action(type="omfwd"
template="AMA_RSYSLOG_TraditionalForwardFormat"
queue.type="LinkedList"
queue.filename="omfwd-azuremonitoragent"
queue.maxFileSize="32m"
queue.maxDiskSpace="1g"
action.resumeRetryCount="-1"
action.resumeInterval="5"
queue.size="25000"
queue.workerThreads="100"
queue.dequeueBatchSize="2048"
queue.saveonshutdown="on"
target="127.0.0.1" Port="28330" Protocol="tcp")

For SELinux hosts using Unix sockets instead of TCP loopback:

$OMUxSockSocket /run/azuremonitoragent/default_syslog.socket
template(name="AMA_RSYSLOG_TraditionalForwardFormat" type="string" string="<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%")
$OMUxSockDefaultTemplate AMA_RSYSLOG_TraditionalForwardFormat
*.* :omuxsock:

On syslog-ng systems, the equivalent lives here:

destination d_azure_mdsd {
	network("127.0.0.1"
	port(28330)
	log-fifo-size(25000));
};
 
log {
	source(s_src);
	destination(d_azure_mdsd);
	flags(flow-control);
};

Most network appliances (firewalls, switches) default to local0–local7 for their own event streams — confirm which facility your device uses before setting DCR severity levels, since a mismatch here silently drops everything.

If your log forwarder sits in the cloud and devices send logs to it over an untrusted network, encrypt the source-to-forwarder hop — the AMA-to-workspace hop is already TLS over 443 by default. Both daemons support it:

Our own production experience lines up with what we've documented before. A full disk stops AMA from functioning, not just from logging locally. Scale proportionally down for smaller ingestion volumes, but don't starve /var/log — the rsyslog buffer described above needs room to work.

Confirm the daemon is actually listening before you send anything:

netstat -lnptv
# Look for rsyslog or syslog-ng bound to port 514

Watch both the external port and the internal AMA forwarding port simultaneously:

sudo tcpdump -i any port 514 or 28330 -A -vv &

Send a synthetic message using logger, targeting a specific facility and severity in RFC 3164 format:

logger -p local4.warn -P 514 -n 127.0.0.1 --rfc3164 -t CEF "0|Mock-test|MOCK|common=event-format-test|end|TRAFFIC|rt=$common=event-formatted-receive_time"

Or send a raw UDP packet with nc for a plain syslog test:

echo -n "<164>CEF:0|Mock-test|MOCK|common=event-format-test|end|TRAFFIC|1|rt=$common=event-formatted-receive_time" | nc -u -w0 localhost 514

Then confirm ingestion — plain syslog lands in Syslog, CEF-formatted messages land in CommonSecurityLog. Allow up to 20 minutes for first arrival.

Syslog
| where TimeGenerated > ago(1h)
| where HostName == "your-forwarder-hostname"
| order by TimeGenerated desc

CommonSecurityLog
| where TimeGenerated > ago(1h)
| where DeviceProduct == "MOCK"

Check service health directly on the forwarder while you're at it:

sudo systemctl status azuremonitoragent.service
sudo systemctl status rsyslog.service      # or syslog-ng.service