Hello,
We have observed that we no longer are receiving Syslog and CEF logs from the Azure Sentinel Log forwarder that is deployed on client premise. I have performed the following steps:
netstat -an | grep 514
Status: Listening or established (which is fine)
netstat -an | grep 25226
Status: Listening or established (which is fine)
sudo tcpdump -A -ni any port 514 -vv
Status: receive logs from the data sources (which is fine)
sudo tcpdump -A -ni any port 514 -vv | grep (Zscaler IP)
Status: receive logs from the Zscaler data source, the logs showed Palo Alto name in the CEF messages which means Zscaler traffic was routed through the firewall (which is fine, as confirmed by client)
sudo tcpdump -A -ni any port 25226 -vv
Status: No logs were received (Issue Identified)
sudo tcpdump -A -ni any port 25226 -vv | grep (Zscaler IP)
Status: No logs were received (Issue Identified)
Restarted the Rsyslog Service:
service rsyslog restart (After service restart, Azure Sentinel Started receiving the syslog. The Syslog data source came up and working fine)
Restarted the OMSAgent Service
/opt/microsoft/omsagent/bin/service_control restart {workspace ID}
Status: There was no status message and prompt came, assuming it restarted in the background (Please confirm if this is the normal, not prompting or showing any message)
After OMS Agent restart, ran tcpdump again on OMS Agent to see if it starts receiving the logs but no luck.
I followed the following link: https://docs.microsoft.com/en-us/azure/sentinel/troubleshooting-cef-syslog?tabs=rsyslog
Can any one guide what probably be the cause of this issue????? Any help will be much appreciated. Thanks in advance.
