Forum Discussion

GOYALS001's avatar
GOYALS001
Copper Contributor
Dec 13, 2022

Issue regarding logs duplication in CEF via AMA method

Hello Everyone,

 

Greeting!!

 

I am configuring my linux machine and I have installed AMA agent on that machine and also run the CEF forwarder script.

 

Link for your reference:

https://learn.microsoft.com/en-us/azure/sentinel/connect-cef-ama#run-the-installation-script

 

The good thing is, I am getting CEF logs in Sentinel in CommonSecurityLog but the problem is same logs are getting in Syslog Schema as well,

 

Anyone here can help me with this issue?

 

I tried to use the method 

sudo su omsagent -c 'python /opt/microsoft/omsconfig/Scripts/OMS_MetaConfigHelper.py --disable'

 

But this method is for OMS Agent,

 

I am here using Azure Monitor Agent,

 

I want to remove the duplicate CEF logs which are coming under Syslog Schema

 

Your help is appreciated, Thanks in Advance.

 

Regards,

Shivam

siem
  • mikhailf's avatar
    mikhailf
    Steel Contributor
    Feb 01, 2023

    Hello GOYALS001 ,

     

    You can filter out facilities from Syslog by configuring your log forwarder.

    Go to Log Analytics Workspace that have Sentinel installed -> Legacy Agents Management -> Syslog. And remove facilities you don't want to be ingested into Syslog.

  • shahkhanmd's avatar
    shahkhanmd
    Copper Contributor
    Feb 01, 2023

    I have similar challenge, Unable to block CEF going to syslog table. Can someone brief the rsyslog configuration to filter facilities . OMS agent have two ports to differentiate the CEF and syslog. where as AMA agent works over Unix Domain Socket, Unable to segregate the CEF and syslog forwarding.

Resources