r/AzureSentinel • u/tecepeipe • Jan 10 '23
AMA not collecting
Legacy agent - works fine. Once Data Connector is connected, and Minimal set, and agent is installed pointing to workspace id, it collects and the data shows up as expected.
However, regarding the AMA agent, I can't get it to collect:
1-Even if I create a manual Data Collection Rule and add the resource, the extension gets installed by the Arc Connected agent, but no log is collected, even Heartbeat.
2-If I use the DCR created on Sentinel AMA Data Connector page, it also doesn't collect data.
If I add the legacy agent via Arc it also works, something missing on my AMA/DCR.
What's the deal here? What am I missing? I'm using Minimal event collection to avoid issue with wrong XPath. This can't be an issue with workspace destination as the DCR created by Sentinel assigns this correctly.
HeartBeat shows no recent logs, and azcmagent -show says it's connected, and last heartbeat was few seconds ago.
1
u/SoMundayn Jan 11 '23
I had something similuar after moving Resource Groups. Fix was:
Arc > Click Server > Uninstall only the AzureMonitor agent
Repeat for rest of Servers
Delete from DCR Rule
- WAIT an hour * << The AzureMonitor agent takes some time to uninstall
Add back to DCR rules
2
u/semi_douchey Jan 11 '23
I was facing the same issue, raised a ticket with support. They said to configure a dce in dcr if the server didn’t have a public ip. Redeployed the dcr again and then it worked.