Home

Cannot add custom log - fails at final step entering name.

%3CLINGO-SUB%20id%3D%22lingo-sub-489353%22%20slang%3D%22en-US%22%3ECannot%20add%20custom%20log%20-%20fails%20at%20final%20step%20entering%20name.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-489353%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20having%20trouble%20pulling%20a%20custom%20log%20from%20a%20Linux%20server%2C%20hosted%20on%20Azure.%26nbsp%3B%20OMS%20is%20talking%20fine.%3C%2FP%3E%3CP%3EWhen%20I%20go%20to%20Work%20space%20settings%20%26gt%3B%20advanced%20settings%20%26gt%3B%20Custom%20Logs%2C%20it%20fails%20to%20add%20at%20the%20last%20step.%26nbsp%3B%20I%20think%20it's%20because%20I%20cannot%20edit%20the%20%22Name%22%20field%20on%20the%20final%20step%2C%20I%20can%20add%2Fedit%20the%20description%20though.%26nbsp%3B%20The%20Next%20button%20stays%20dim%20%3A(%3C%2Fimg%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20629px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F110733iDDF551401D9BC72C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Custom%20Log%20-%20Azure%20Sentinel.png%22%20title%3D%22Custom%20Log%20-%20Azure%20Sentinel.png%22%20%2F%3E%3C%2FSPAN%3E.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-489714%22%20slang%3D%22en-US%22%3ERe%3A%20Cannot%20add%20custom%20log%20-%20fails%20at%20final%20step%20entering%20name.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-489714%22%20slang%3D%22en-US%22%3E%3CP%3EOK%20it's%20working%2C%20user%20error%20(me).%3C%2FP%3E%3CP%3EThe%20_CL%20cannot%20be%20removed%2C%20you%20have%20to%20prepend%20a%20title%2C%20in%20my%20case%20%22Cowrie_honeypot_CL%22.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAlso%20as%20a%20side%20note%2C%20struggled%20getting%20the%20OMS%20agent%20installed%20initially%2C%20copying%20the%20one-liner%20installer%20failed%20and%20running%20%22%2Fopt%2Fmicrosoft%2Fomsagent%2Fbin%2Fomsadmin.sh%20-l%22%20showed%20no%20work%20spaces%20listed.%26nbsp%3B%20Ran%20%22omsagent.sh%20-X%22%20and%20then%20%22omsagent.sh%20-w%20xxx%20-s%20xxx%22%20got%20it%20working%2C%20a%20work%20space%20was%20listed%20then%20and%20good%20to%20go.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-499068%22%20slang%3D%22en-US%22%3ERe%3A%20Cannot%20add%20custom%20log%20-%20fails%20at%20final%20step%20entering%20name.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-499068%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F63812%22%20target%3D%22_blank%22%3E%40Neil%20Williams%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAwesome%20to%20hear%20you%20got%20this%20taken%20care%20of%2C%20thanks%20for%20sharing%20your%20feedback.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Neil Williams
New Contributor

Hi All,

 

I'm having trouble pulling a custom log from a Linux server, hosted on Azure.  OMS is talking fine.

When I go to Work space settings > advanced settings > Custom Logs, it fails to add at the last step.  I think it's because I cannot edit the "Name" field on the final step, I can add/edit the description though.  The Next button stays dim :(

 


Custom Log - Azure Sentinel.png.

 

  

 

2 Replies

OK it's working, user error (me).

The _CL cannot be removed, you have to prepend a title, in my case "Cowrie_honeypot_CL".

 

Also as a side note, struggled getting the OMS agent installed initially, copying the one-liner installer failed and running "/opt/microsoft/omsagent/bin/omsadmin.sh -l" showed no work spaces listed.  Ran "omsagent.sh -X" and then "omsagent.sh -w xxx -s xxx" got it working, a work space was listed then and good to go.

@Neil Williams 

 

Awesome to hear you got this taken care of, thanks for sharing your feedback.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies