Forum Discussion

AndrewX's avatar
AndrewX
Iron Contributor
May 31, 2019

OMS DNS Analytics solution - no data

Hello - I am trying to get DNS logs into Log Analytics and into Sentinel.   The Documentation here (https://docs.microsoft.com/en-us/azure/sentinel/connect-dns), says simply install OMS and check t...
azure monitor
microsoft sentinel
SBI_Team's avatar
SBI_Team
Copper Contributor
Dec 29, 2019

CliveWatsonI have been 'enrolled' in the DNS Analytics preview for weeks but have never had any query events captured.

 

I have events of type ConfigurationChange and DynamicRegistration only.

I also have hearbeat from around a dozen Windows DCs running DNS.

 

As per your suggestion I have made a configuration change in order to 'reset` the config. I have then waited for a while, done some web searches to obscure websites on a member server and waited for these to show up in Log Analytics - they have not.

 

 

Scott_Willmott's avatar
Scott_Willmott
Copper Contributor
Feb 25, 2020

Did anyone manage to find a solution to this? getting the exact same issue, 8 DNS servers enrolled, all showing active heartbeats, dynamicRegistration & Configuration Change events coming through fine, but no LookupQuery events ever occur. 

  • ActualCassandra's avatar
    ActualCassandra
    Copper Contributor
    Jun 14, 2020

    Anyone gotten this to work? I cannot get it to work (LA shows a connection to the computer, running Server 2019, so it's a DNS connector issue). Last post on the github referenced before me also shows no resolution. Definitely have DNS analytic logs enabled and logging is happening locally. Other sources such as Security Events are showing up.

     

    Edit: It is working now, after I removed the connector yet again, then changed the config to one setting and then changed config again and saved it. Obviously there is something buggy here, but it seems to have gotten events in now...