Forum Discussion

Etienne Noiret's avatar
Etienne Noiret
Icon for Microsoft rankMicrosoft
Mar 19, 2019

Failed to configure/use CEF syslog facility

Hello,

 

I'm stuck with the configuration of CEF connector as described at https://docs.microsoft.com/en-us/azure/sentinel/connect-common-event-format. I have chosen to go for an automatic deployment, so I'd expect everything works out of the box, but still I have issues:

- There seems to be no process listening on UDP (or TCP) port 514 in the created VM. I had to modify several lines in the config to enable this.

- When sending messages to this port, nothing gets forwarded to port 25226

- When sending messages directly to port 25226, I encounter the following warning message in omsagent.log:  pattern not match: "blabla"

Is there a command line or utility I can use to send a simple CEF text message and have it been acquired by the VM and sent to Sentinel? The CommonSecurityLogs table remains desperately empty...

 

Thanks for the help!

 

Etienne

8 Replies

    • Chris Boehm's avatar
      Chris Boehm
      Former Employee
      Apr 25, 2019

      Rohan Cragg 

      Etienne Noiret 

       

      Whenever you're configuring the rsyslog service we're pushing a security_events.conf file as part of the integration process ( creating a listener for port 25226 )

       

      Example in the steps:

       

      Download and install the security_events config file that configures the Syslog agent to listen on port 25226.

      sudo wget -O /etc/opt/microsoft/omsagent/{0}/conf/omsagent.d/security_events.conf "https://aka.ms/syslog-config-file-linux"

      Where {0} should be replaced with your workspace GUID.

       

       

      Security_events.conf

       

      <source>
        type syslog
        port 25226
        bind 127.0.0.1
        protocol_type udp
        tag oms.security
        format /^(?<time>(?:\w+ +){2,3}(?:\d+:){2}\d+):? ?(?:(?<host>[^: ]+) ?:?)? (?<ident>[a-zA-Z0-9_%\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?: *(?<message>.*)$/
        message_length_limit 4096
      </source>
      <filter oms.security.**>
        type filter_syslog_security
      </filter>
       
       
      You'll note the config file has UDP, please move it to TCP if you're using TCP and restart the service.
      This should fix the communication issues
       
      I'd advise following this doc for testing your communication: https://docs.microsoft.com/en-gb/azure/sentinel/connect-fortinet#step-3-validate-connectivity 
       
      • LauraPen's avatar
        LauraPen
        Copper Contributor
        Jun 17, 2019

        Chris Boehm 

         

        We're having a similar issue.  I've verified that I have the security events.conf file on my server ,and that the Fortinet logs I'm pulling are in CEF format. 

        The logs are screaming in on 514 - but never go to Sentinel on 25266.  Anything else I can check?  Would setting the syslog port to 25266 on the firewall help at all?

         

        CEF:0|Fortinet|Fortigate|v6.0.2


        -rw-r--r-- 1 root root 359 Feb 12 01:58 /etc/opt/microsoft/omsagent/6e7121df-eea3-4365-b775-410954a08c7d/conf/omsagent.d/security_events.conf