Forum Discussion

ShawnMay's avatar
ShawnMay
Copper Contributor
Feb 23, 2020

MCAS - Log Collector - Configuration Not Sending to MCAS

I'm fairly new to MCAS.  Am attempting to get an onPrem log collector (docker) to transmit ASA logs to the log collector in MCAS. However, something is not working.

 

This docker instance is running within a hyper-v 2016 guest (Guest: Windows Server 2019). 

 

The source is an ASA 5508 sending syslog (level 6) to the docker instance on TCP 20000.  Host firewall inbound rule allows TCP 20000 from the ASA.

 

Within Azure MCAS, it shows the log collector is "Connected" - Warning: No data was received since log collection deployment.  Make sure you complete on-premises configuration of your network appliances.

 

From a review of a NetMon network trace, run from the host, we are receiving traffic from the ASA on TCP 20000.  Netstat does show the server is listening on TCP 20000.  Below is docker run command.

 

Have opened a case with MS, but they claim to be new as MCAS and docker.

 

Any ideas why I'm not getting data?

 

docker run
--name ASALogCollector
-p 20000:20000/tcp
-p 21:21
-p 20001-20099:20001-20099

-e "PUBLICIP='internalhost.acme.com'"
-e "PROXY="
-e "SYSLOG=true"
-e "CONSOLE=xxxxx.us3.portal.cloudappsecurity.com"
-e "COLLECTOR=ASALogCollector"

--security-opt apparmor:unconfined
--cap-add=SYS_ADMIN
--restart unless-stopped
-a stdin
-i microsoft/caslogcollector starter

5 Replies

  • Hi Shawn,

    Can you please PM me with your case Id, so that I can make sure it is being handled by our support experts?

    Thanks,
    Danny.
    • tgreed99's avatar
      tgreed99
      Copper Contributor

      Danny Kadyshevitch Was this resolved? I am having the same problem. My log collector is receiving ftp log files from my Palo Alto NGFW but not sending them to MCAS.

      • ShawnMay's avatar
        ShawnMay
        Copper Contributor

        tgreed99 

         

        Here is the configuration I used to get around this mess.  1025 corresponds to the internal docker port, and 601/tcp is the host's ports.

         

        docker run
        --name ACMEASALogCollector
        -p 1025:601/tcp  <----
        -p 21:21

        -p 20000-20099:20000-20099

  • Steven Shockley's avatar
    Steven Shockley
    Copper Contributor

    ShawnMay 

     

    Do you see a lot of lsof processes running taking up a lot of CPU time?  I had to bypass the lsof process in the container (remove lsof, link /bin/true to lsof) to get it to work.  I understand that's fixed in the current version though.  If you do see high CPU usage by lsof let me know and I'll provide detailed instructions.

Resources