Failed to configure/use CEF syslog facility

LauraPen 

If you're seeing everything on 514 but not 25226 it seems like the forwarding isn't occurring correctly.

Confirm the configuration file

Make sure you've restarted the service, after adding the configuration change it requires a reboot to start up the new security file configuration.

I would confirm the following:

For rsyslog, ensure the following is in the configuration file for CEF

:msg, contains, "CEF"       @127.0.0.1:25226

if the configuration file seems to be configured correctly, I would personally advise collecting the following information:

• Files:
  • /etc/opt/microsoft/omsagent/<workspace id>/conf/omsagent.d/security_events.conf
  • /var/opt/microsoft/omsagent/<workspace id>/log/omsagent.log
  • /etc/rsyslog.conf
  • The content of folder: /etc/rsyslog.d/

• Output of the following commands:
  1. CEF logs is the correct format in the var/messages file ("tac /var/log/syslog | grep CEF -m 10" or "tac /var/log/messages | grep CEF -m 10")
  2. TCP dump on ports 514 and 25226  ("tcpdump -i any dst port 514 -vv" or "tcpdump -i any dst port 25226 -vv")

Then create a support ticket if my comment above didn't help.