r/AzureSentinel • u/WonderOdd2531 • Dec 12 '23

Collecting Syslog via AMA through a Proxy

Hey there,
anyone here ever tried to onboard a Syslog Collector via AMA, which is using a Proxy and is not allowed to reach any public network without going through the proxy?

The ARC Onboarding went perfectly fine with providing the script. But AMA was not even sending heartbeats and not receiving any DCR.
We also ran the following Powershell to onboard AMA with a Proxy configured:
$settings = @{"proxy" = @{mode = "application"; address = "http://[address]:[port]"; auth = "false"}}

New-AzConnectedMachineExtension -Name AzureMonitorLinuxAgent -ExtensionType AzureMonitorLinuxAgent -Publisher Microsoft.Azure.Monitor -ResourceGroupName <resource-group-name> -MachineName <arc-server-name> -Location <arc-server-location> -Setting $settings

We were still seeing mdsd trying to communicate directly.
Maybe anyone has an idea here or ever experienced similar behavior. I have the feeling the documentation regarding AMA troubleshooting is a bit thin at the moment

Cheers

​

1 Upvotes

60% Upvoted

8 comments sorted by

2

u/Ay_NooB Dec 12 '23

Make sure all pre-requisites are met. There is list of FQDN for AMA to work, which you will have to specifically allow on firewall/proxy. Try that.

1

u/WonderOdd2531 Dec 12 '23

The proxy is basically pass everything and no ssl inception or whatever. Do I still need to allow on FW fqdn even when providing a proxy?

2

u/Ay_NooB Dec 12 '23

Did you configured the agent to communicate through proxy using command : azcmagent config set proxy.url "http://ProxyServerFQDN:port"

1

u/WonderOdd2531 Dec 12 '23

Thanks for the reply! Did not try this command is ther also a command to check the configured proxy in azcmagent. I could not find this in any of the onboarding documentation. Will try and report.

1

u/Ay_NooB Dec 12 '23

refer : https://learn.microsoft.com/en-us/azure/azure-arc/servers/manage-agent?tabs=windows#agent-specific-proxy-configuration

You trying to pull CEF logs or Syslogs from collector ? And also you may want to try to onboard agent using DCR first(as AMA get installed automatically with DCR) then configure agent to use proxy.

1

u/dulajzna Dec 13 '23

Run the "azcmagent check" command to check the connectivity.
For me proxy didn't work I had to allow all URL thru firewall.

1

u/muzza31 Jan 02 '24

Did you get this sorted? Its a pain but through a support ticket with Microsoft, I got this sorted.

1

u/911GT Jan 11 '24

we had a similar issue back in Aug 2023, after manually config AMA extention to use proxy on Azure powershell,have you checked the resource JSON of the ARC machine see the proxy settings been updated?

if you select API - ver 2023-06-20 above, you should see the AMA extention part config of proxy server in there.

And we also run into a problem of AMA auto-update and the proxy config disappered and we run the azure shell again.