How to forward custom application logs from Solaris Web Application to Microsoft Sentinel

[FahadAhmed]

Hello All,

One of our client has Solaris server with custom application running on it that is writing the application logs to local application log file. We need to integrate that log file with Microsoft Sentinel. I believe MMA agent cannot perform this job. 

I think we need to install Logstash with File Input plugin and Azure Log Analytics output plugin and specify the path to read the log files.

My question is :

Can we install Logstash directly on the Solaris machine where the logs are available locally?? or we need to install it on a separate machine and then provide some kind of connectivity to fetch the logs from the solaris machine so they are forwarded to Sentinel.

Also can we use "beats" ?? I was thinking if we can install beats on the solaris server that reads the log log files and directly forward to Azure sentinel rather than beats---> Logstash ----> sentinel. Can we just have Beats---> Sentinel????

Please guide since I am confused on this.

Thanks

Fahad.

[#2]

You may want to see if the Azure Monitor Agent will work for you. You can define which logs you want to ingest. https://docs.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview?tabs=PowerS...

[#3]

Hi Gary, Thank you for the quick response. The solaris server is on premise, as far as I am aware of, AMA agent can only be installed if Azure ARC is deployed on the solaris server? Correct me if I am wrong? Thanks

[#4]

Also in the link provided by yourself under Limitations , it says "

• No support for collecting file based logs or IIS logs." so file based logs cannot be collected. Please mention if the newer versions supports this or not?

[#5]

That is correct.

[#6]

Sorry, I thought you were writing to the Windows log system. If you are just logging to a file then the AMA will not work for you.

[#7]

@Gary Bushey  how we can achieve logs present in flat files in *nix system (in on-prem) to Sentinel workflow ? Any specific methodology is there to do so ? 

[#8]

I don't think there is anything out of the box to handle this, but it can be done using a Logic App