OMS Agent on Azure Sentinel Log forwarder not receiving and forwarding logs to sentinel workspace

Hi alazarg 

Check your /etc/rsyslog.d/50-default.conf file. It has a section like this:

#
# First some standard log files.  Log by facility.
#
#auth,authpriv.*                        /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
#cron.*                         /var/log/cron.log
#daemon.*                       -/var/log/daemon.log
kern.*                          -/var/log/kern.log
#lpr.*                          -/var/log/lpr.log
mail.*                          -/var/log/mail.log
#user.*                         -/var/log/user.log

The problem is line 5 where any facility (*.*) is written to /var/log/syslog file. Solution is to either comment it out (using #) or even better:

#
# First some standard log files.  Log by facility.
#
if ($fromhost-ip == '127.0.0.1') then {
  #auth,authpriv.*                        /var/log/auth.log
  *.*;auth,authpriv.none          -/var/log/syslog
  #cron.*                         /var/log/cron.log
  #daemon.*                       -/var/log/daemon.log
  kern.*                          -/var/log/kern.log
  #lpr.*                          -/var/log/lpr.log
  mail.*                          -/var/log/mail.log
  #user.*                         -/var/log/user.log
}

Then only local generated logs will be written to the filesystem and the disk will not be filled.

Good luck.

/Kenneth ML