2.2.3. Syslog and CEF via AMA

💡 First Principle: Network appliances and Linux systems speak syslog, a simple stream of text messages sent over the network, usually on port 514. They can't run an Azure agent themselves, so the pattern is to point them at a Linux log forwarder that runs a syslog daemon to receive the messages and AMA to ship them. CEF (Common Event Format) is a structured message format carried inside syslog, which is why it uses the same forwarder.

Setup follows a predictable sequence, which makes it good drag-drop material:

1. Install the Syslog or Common Event Format solution from Content hub to get the AMA-based connector.
2. Prepare the forwarder: a supported Linux VM with Python and rsyslog or syslog-ng, made Azure Arc-enabled if it isn't an Azure VM, with enough disk (a full disk stops AMA).
3. Create the DCR from the connector page: select the forwarder as a resource and choose facilities and minimum severities to collect. The connector deploys AMA to the selected machine.
4. Run the installation script on the forwarder; it configures the daemon to listen on port 514 (UDP and TCP) and pass messages to AMA.
5. Configure the appliances to send to the forwarder's address, then verify with a test message and a query against the destination table.

Severity selection works as a floor: choosing LOG_ERR for a facility collects that level and everything more severe (critical, alert, emergency). Facilities matter for a subtler reason: if the Syslog connector and the CEF connector both collect the same facility, the same messages can be ingested twice. Assign different facilities to CEF sources and plain syslog sources, or design the DCRs so they don't overlap. For production, deploy more than one forwarder behind a load balancer, and use TLS between sources and forwarder when the logs cross untrusted networks.

⚠️ Exam Trap: Appliances do not send CEF directly to the workspace. "Configure the firewall to send CEF to the Log Analytics workspace endpoint" is wrong; the firewall sends to the Linux forwarder, and AMA on the forwarder ships to Sentinel. A second trap: CEF lands in CommonSecurityLog, plain syslog lands in Syslog.

Reflection Question: After enabling both the Syslog via AMA and CEF via AMA connectors on the same forwarder, analysts notice identical firewall events appearing in two tables and ingestion costs jumping. What's the likely cause, and what change fixes it?