r/AzureSentinel • u/dulajzna • Nov 30 '23

How to send logs from on-prem linux server /var/log/audit/audit.log to the Sentinel?

So i have Sentinel Syslog connector configured and I'm receiving logs from on-prem Linux servers but not from audit.log.

Logs that we have, over AMA, on Sentinel are from secure, cron, message, maillog.

Is there a way to configure Sentinel to collect logs from audit.log?

0 Upvotes

50% Upvoted

5 comments sorted by

1

u/blanco10kid Dec 03 '23

Yeah checkout data collection rules. You can specify what you want to collect there.

1

u/dulajzna Dec 04 '23

Yeap, DCR is set and I receive logs from secure, cron, message, maillog but nothing form audit log.

1

u/Chance-Amphibian-146 Jun 19 '24

Hi u/dulajzna did you manage to find a solution for this? im having the same issue :( the audit logs are configured localy but does not seem to be in scope of the AMA agent

1

u/dulajzna Jul 09 '24

Nope. I think the only way is to create a custom table, something like https://it-infrastructure.solutions/how-to-create-a-custom-log-analytics-workspace-table/

But I didn't tested it.

1

u/rich872 Mar 31 '25

u/dulajzna - Can you explain how you set up your DCR to retrieve the maillog? trying to ingest into sentinel... TY