How to select multiple log levels in a data collection rule for Linux syslog facilities ?

$@chin 115

Checking the possibility of selecting multiple min log levels for Linux syslog under a data collection rule for each facilities ?

User's image

In legacy log management systems, there is an option to select multiple min log level categories for the facility available under the Log Analytics workspace. Since this option is deprecating end of august 2024 and migrated to AMA.

should I create multiple data collection rules based on the number of min log levels for each facility ?

Rahul Podila 110 Reputation points Microsoft Vendor

2024-09-23T12:13:38.6333333+00:00
Hi @$@chin
Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

List the types of logs to monitor (e.g., auth, daemon, user).

Determine the minimum log levels needed for each (e.g., info, warn, error).

Set up a new rule in AMA for each type and log level.

Rule 1: Track auth logs at info.

Rule 2: Track auth logs at warn.

Rule 3: Track daemon logs at warn.

Rule 4: Track user logs at error.

Use the Azure portal to set up the rules easily.

After setup, verify that you're receiving the correct logs.

Keep a record of each rule and its purpose for future reference.

You’ll capture all the logs you need.

Modifying the rules will be straightforward if your requirements change.

You can easily adjust to any new logging needs that arise.

If you have any further quires, do let us know

If the answer is helpful, please click "Accept Answer" and "Upvote it".
Rahul Podila 110 Reputation points Microsoft Vendor

2024-09-25T06:22:31.9766667+00:00

Hi @$@chin If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!
Rahul Podila 110 Reputation points Microsoft Vendor

2024-09-27T06:53:45.98+00:00

Hi @$@chin
If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!
$@chin 115 Reputation points

2024-09-29T16:14:15.4+00:00

That means I have to create multiple data collection rules. that’s the only option. I need to create 10-15 data collection rules to collect these logs. The legacy feature is better in terms of this functionality because it allows us to choose a specific option, which varies based on individual requirements. Nevertheless, I hope Microsoft will release an feature update that allows multiple options within a single rule.
Rahul Podila 110 Reputation points Microsoft Vendor

2024-10-29T03:25:41.3433333+00:00

Hi @$@chin
My Apologies for the late comeback
while the legacy log management system allowed for selecting multiple options within a single rule, the new Azure Monitor Agent (AMA) does not currently support this functionality. Therefore, the customer will need to create multiple data collection rules, each with a different minimum log level for the specific facility they want to monitor. This approach has several benefits, including capturing all the logs needed, making it easy to modify the rules if requirements change, and being able to adjust to any new logging needs that arise.
If you have any further quires, do let us know

If the answer is helpful, please click "Accept Answer" and "Upvote it".

Share via

How to select multiple log levels in a data collection rule for Linux syslog facilities ?

Your answer