Cannot add custom log - fails at final step entering name.

%3CLINGO-SUB%20id%3D%22lingo-sub-489353%22%20slang%3D%22en-US%22%3ECannot%20add%20custom%20log%20-%20fails%20at%20final%20step%20entering%20name.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-489353%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20having%20trouble%20pulling%20a%20custom%20log%20from%20a%20Linux%20server%2C%20hosted%20on%20Azure.%26nbsp%3B%20OMS%20is%20talking%20fine.%3C%2FP%3E%3CP%3EWhen%20I%20go%20to%20Work%20space%20settings%20%26gt%3B%20advanced%20settings%20%26gt%3B%20Custom%20Logs%2C%20it%20fails%20to%20add%20at%20the%20last%20step.%26nbsp%3B%20I%20think%20it's%20because%20I%20cannot%20edit%20the%20%22Name%22%20field%20on%20the%20final%20step%2C%20I%20can%20add%2Fedit%20the%20description%20though.%26nbsp%3B%20The%20Next%20button%20stays%20dim%20%3A(%3C%2Fimg%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20629px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F110733iDDF551401D9BC72C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Custom%20Log%20-%20Azure%20Sentinel.png%22%20title%3D%22Custom%20Log%20-%20Azure%20Sentinel.png%22%20%2F%3E%3C%2FSPAN%3E.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-489714%22%20slang%3D%22en-US%22%3ERe%3A%20Cannot%20add%20custom%20log%20-%20fails%20at%20final%20step%20entering%20name.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-489714%22%20slang%3D%22en-US%22%3E%3CP%3EOK%20it's%20working%2C%20user%20error%20(me).%3C%2FP%3E%3CP%3EThe%20_CL%20cannot%20be%20removed%2C%20you%20have%20to%20prepend%20a%20title%2C%20in%20my%20case%20%22Cowrie_honeypot_CL%22.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAlso%20as%20a%20side%20note%2C%20struggled%20getting%20the%20OMS%20agent%20installed%20initially%2C%20copying%20the%20one-liner%20installer%20failed%20and%20running%20%22%2Fopt%2Fmicrosoft%2Fomsagent%2Fbin%2Fomsadmin.sh%20-l%22%20showed%20no%20work%20spaces%20listed.%26nbsp%3B%20Ran%20%22omsagent.sh%20-X%22%20and%20then%20%22omsagent.sh%20-w%20xxx%20-s%20xxx%22%20got%20it%20working%2C%20a%20work%20space%20was%20listed%20then%20and%20good%20to%20go.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-499068%22%20slang%3D%22en-US%22%3ERe%3A%20Cannot%20add%20custom%20log%20-%20fails%20at%20final%20step%20entering%20name.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-499068%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F63812%22%20target%3D%22_blank%22%3E%40Neil%20Williams%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAwesome%20to%20hear%20you%20got%20this%20taken%20care%20of%2C%20thanks%20for%20sharing%20your%20feedback.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hi All,

 

I'm having trouble pulling a custom log from a Linux server, hosted on Azure.  OMS is talking fine.

When I go to Work space settings > advanced settings > Custom Logs, it fails to add at the last step.  I think it's because I cannot edit the "Name" field on the final step, I can add/edit the description though.  The Next button stays dim :(

 


Custom Log - Azure Sentinel.png.

 

  

 

2 Replies
Highlighted

OK it's working, user error (me).

The _CL cannot be removed, you have to prepend a title, in my case "Cowrie_honeypot_CL".

 

Also as a side note, struggled getting the OMS agent installed initially, copying the one-liner installer failed and running "/opt/microsoft/omsagent/bin/omsadmin.sh -l" showed no work spaces listed.  Ran "omsagent.sh -X" and then "omsagent.sh -w xxx -s xxx" got it working, a work space was listed then and good to go.

Highlighted

@Neil Williams 

 

Awesome to hear you got this taken care of, thanks for sharing your feedback.