Hands-on managing Linux on Azure

Linux logs can be ingested into the Log Analytics workspace. In this hands-on exercise, we will see how we can ingest the syslog from our migrated Linux machine into the Log Analytics workspace and analyze it using Kusto Query Language (KQL).

Syslog is an event logging protocol that is widely used in Linux. The messages sent by the applications may get stored on the local machine or delivered to a syslog collector. Using the Linux Log Analytics agent, we will configure the syslog daemon to forward these syslog entries to the agent, and the agent will then send the messages to the Log Analytics workspace, which is part of Azure Monitor. Here, we are using the Log Analytics agent to push the data to the Log Analytics workspace.

Figure 5.10 is a graphical representation of how data is sent to Azure Monitor from the Linux machine:

Figure 5.10: Sending syslog messages to Azure Monitor

The syslog collector supports the...