Diagram
A linear flow showing Linux-based systems sending logs through the Syslog daemon to the Azure Monitor Agent, then to the Log Analytics workspace, where plain Syslog messages are stored in the Syslog table and CEF-formatted messages in the CommonSecurityLog table.
Syslog and Common Event Format
For Linux-based systems, you can use the Azure Monitor Agent (AMA) to send logs into Microsoft Sentinel. The AMA can run directly on the device or on a separate Linux-based log forwarder. The Syslog daemon collects local events and forwards them to the agent, which then streams the events to your Log Analytics workspace. After setup, plain Syslog messages appear in the Syslog table, while CEF-formatted messages go to the CommonSecurityLog table.
Domain 4 of 6
2 practice questions
Practice this DomainLast updated