Forum Discussion

Iron Contributor

Jun 01, 2019

OMS DNS Analytics solution - no data

Hello - I am trying to get DNS logs into Log Analytics and into Sentinel. The Documentation here (https://docs.microsoft.com/en-us/azure/sentinel/connect-dns), says simply install OMS and check t...

azure monitor

microsoft sentinel

CliveWatson

Silver Contributor

Jun 03, 2019

AndrewX

Generally after you put the agent on the Windows Server that is running DNS, you will get the logs.

Is this the first time you've used Log Analytics - if not, do you have other data sources that are working (this can rule out proxy/firewall issues)?

https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agent-windows

Did you "Verify agent connectivity to Log Analytics" as per the above link?

https://docs.microsoft.com/en-us/services-hub/health/troubleshooting_mma_agent

MattM2020
Copper Contributor
Dec 18, 2019
CliveWatson

I'm actually experiencing the same issue. Enabled the collection about 18 hours ago and nothing is coming in to Log Analytics. My connectivity is working properly and other events come in properly but nothing for DNS.
- CliveWatson
  Silver Contributor
  Dec 18, 2019
  MattM2020
  
  See here: https://docs.microsoft.com/en-us/azure/azure-monitor/insights/dns-analytics#troubleshooting
  - MattM2020
    Copper Contributor
    Dec 18, 2019
    CliveWatson
    
    Hmm, when it says to reset the config or load the config page once in the portal, where, specifically, is it referring to? I've done changes within the Overview > DNS Analytics > DNS Analytics Configuration section so if that is it, that's been done with no change in the lack of events coming in.