Azure Sentinel - Dual Syslog Forwarding

[a-balde]

We have a CentOS 7 syslog server running rsyslog and receiving messages on UDP 514. Is it supported to forward syslog messages from this server to a remote collector using the rsyslog daemon while the OMS agent is installed and also forwarding syslog messages to Azure Sentinel? We have noticed most of the messages are going to Azure Sentinel and the remote syslog collector only receiving some messages so because of the messages been potentially split both the remote syslog collector and Azure Sentinel are missing some messages. In the logs we noticed the UDP buffer been full so increased the buffer size from 2MB to 25MB. Forwarding to the remote syslog collector is configured like this in the rsyslog.conf file *.* @192.168.2.56:514 and the Workspace has all the syslog facilities enabled with all severity levels.

[#2]

I don't remember how to do it but rsyslog supports forwarding logs to a secondary destination.

[#3]

@a-balde : to avoid event loss I suggest moving to TCP, using 

 *.* @@192.168.2.56:514

Naturally, you will need to have to also support TCP on the recieving rsyslog.

I would suggest also moving to TCP for sending to Sentinel as described here: "The log forwarder deep dive webinar (plus a bonus: learn how to use it to filter events)":  YouTube, MP4, Deck