top of page
Search

Collecting CEF log using Azure Monitor Agent (AMA agent). Unable to install CEF collector on RHEL8.

We were working on configuring the Data Connector "Common Event Format (CEF) via AMA" in Microsoft Sentinel .



While running the CEF installer on RHEL 8 server

sudo wget -O Forwarder_AMA_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Forwarder_AMA_installer.py&&sudo python Forwarder_AMA_installer.py


We got the error –

Could not detect any running Syslog daemon on the machine. The supported Syslog daemons are Rsyslog and Syslog-ng. Please install one of them and run this script again.


rsyslog or syslog-ng are not running on the server. Aborting the installation.


So we tried checking the status of the rsyslog service and got the error message. As a next step we initiated the start of the rsyslog service by running command -

sudo service rsyslog start

However, it failed with error –

Redirecting to /bin/systemctl start rsyslog.service

Job for rsyslog.service failed because the control process exited with error code.

See "systemctl status rsyslog.service" and "journalctl -xe" for details.


For further details we executed the command - journalctl -xe


SELinux is preventing /usr/sbin/rsyslogd from read access on the file /etc/rsysl>

SELinux is preventing /usr/sbin/rsyslogd from read access on the file /etc/rsysl>


So to solve this issue we actually first stopped the SELinux by executing the command –

sudo setenforce 0


And then command –

restorecon -Rv /etc


Reference – https://bugzilla.redhat.com/show_bug.cgi?id=1160445


Finally we were able to execute the below commands successfully and able to install the CEF collector on RHEL –


service rsyslog restart


sudo wget -O Forwarder_AMA_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Forwarder_AMA_installer.py&&sudo python Forwarder_AMA_installer.py



P.S. This blog covers the specific scenario and its not a generic solution for every CEF installation issue. Please execute the above commands very carefully. We don't own any responsibility incase of any failure to the server. Views are my own and doesn't represent my employer.

21 views0 comments

Recent Posts

See All
bottom of page