#Ubuntu syslog-ng to Sentinel via AMA Forwarder

1 messages · Page 1 of 1 (latest)

turbid oracle
#

Hi all - first time posting here but I am really stuck (and new to all of this). We have a requirement where we need the logs from our Meraki firewalls to be forwarded to Microsoft Sentinel. To try and achieve this I have:

  1. Built a Ubuntu Server 24.04 LTS on premise
  2. Installed syslog-ng and I am sending Meraki firewall logs via UDP 514 to this server - I can see them if I run - tail -f /var/log/syslog
  3. Connected the VM to Azure ARC so it shows up in Azure
  4. Added the connector "Syslog via AMA" to Sentinel and created a Data Collection Rule for it (all options in Debug). I then run the AMA Forwarder install script on the VM which says it installed successfully, but the Syslog via AMA connector in Sentinel remains "Disconnected"

I've tried so many troubleshooting steps but noted there is a troubleshooting script [sentinel_AMA_troubleshoot.py] available which gives me the following output. It seems like the DCR created simply never makes it back to the Ubuntu server so it's not collecting anything. We don't have any firewall restrictions at the moment. Does anyone have some guidance or suggestions on trying to work this out?

#

Output of the AMA troubleshooting script (broken across 2 posts due to char limit):

2026-03-05 15:31:37 (3.26 MB/s) - ‘sentinel_AMA_troubleshoot.py’ saved [49903/49903]

The scenario chosen is: CEF

Starting to run the validation script for the cef scenario
Please validate you are sending messages to the agent machine

----- Starting validation tests for AMA ---------------------------
verify_ama_agent_service_is_running------------> Success
Detected AMA running version- 1.40.0
Detected ARC installed on the machine: azcmagent version 1.61.03319.859
verify_oms_agent_not_running-------------------> Failed to check
Error running command: sudo netstat -lnpvt | grep ruby. Command does not exist. Please install it and run again.
/home/username/sentinel_AMA_troubleshoot.py:301: DeprecationWarning: distutils Version classes are deprecated. Use packaging.version instead.
IS_AGENT_VERSION_UPDATED = StrictVersion(UPDATED_AGENT_VERSION) <= StrictVersion(AGENT_VERSION)

----- Starting validation tests for data collection rules ---------
verify_DCR_exists------------------------------> Success
verify_DCR_content_has_stream------------------> Failure
Could not detect any data collection rule for the provided datatype. No such events will be collected from this machine to any workspace. Please create a DCR using the following documentation- https://docs.microsoft.com/azure/azure-monitor/agents/data-collection-rule-overview and run again

----- Starting validation tests for the Syslog daemon -------------
verify_Syslog_daemon_listening-----------------> Failed to check
Error running command: sudo netstat -lnpv | grep syslog-ng. Command does not exist. Please install it and run again.
verify_Syslog_daemon_forwarding_configuration--> Success

Data collection rules in Azure Monitor - Azure Monitor

Overview of data collection rules (DCRs) in Azure Monitor including their contents and structure and how you can create and work with them.

#

----- Starting validation tests for the operating system ----------
/home/username/sentinel_AMA_troubleshoot.py:591: DeprecationWarning: distutils Version classes are deprecated. Use packaging.version instead.
if StrictVersion(AGENT_VERSION) < StrictVersion(AGENT_MIN_HARDENING_VERSION):
verify_selinux_state---------------------------> Success
verify_iptables_policy_permissive--------------> Success
verify_iptables_rules_permissive_514-----------> Success
verify_iptables_rules_permissive_28330---------> Success
verify_free_disk_space-------------------------> Success

----- Starting validation tests for capturing incoming events -----
Attempting to capture events using tcpdump. This could take up to 10 seconds.
Could not locate CEF message in tcpdump. Please verify CEF events can be sent to the machine and there is not firewall blocking incoming traffic
listen_to_incoming_events----------------------> Failure

Generating mock events and trying again
Attempting to capture events using tcpdump. This could take up to 10 seconds.
listen_to_incoming_events----------------------> Success
Found CEF in stream. Please verify CEF events arrived at your workspace

Total amount of tests that failed to run: 1

Total amount of failed tests is: 2
This script generated an output file located here - /tmp/troubleshooter_output_file.log
Please review it if you would like to get more information on failed tests.

If you would like to open a support case please run this script with the 'collect' feature flag in order to collect additional system data for troubleshooting.'python Sentinel_AMA_troubleshoot.py [STREAM_OPTION] collect'v

turbid oracle
#

Turns out after all that it just magically started working on it own after an hour or so 🤷‍♂️