Can we use a single Linux/ Windows agent to collect logs from multiple log sources in Sentinel?

[MiteshAgrawal]

Hi Everyone,

Can we use a single Linux/ Windows agent to collect logs from multiple log sources in Sentinel?

Regards,

Mitesh Agrawal

[#2]

@MiteshAgrawal 

Yes you can do that with Windows. Though I wouldn't be able to tell how to do that in Linux.

[#3]

@MiteshAgrawal 

You can configure the MMA (Windows and Linux)  in the Log Analytics - Advanced Settings

You can add multiple sources to each platform. https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agent-data-sources