How can I send auth log to Sentinel from Linux server ?How can I stop sentinel agent in a Linux box ?

ankitd 1. You can configure auth and authpriv using the Syslog Agent https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-syslog 2. Scxadmin https://docs.microsoft.com/en-us/system-center/scom/manage-security-administer-crossplat-agent?view=sc-om-2019