Advertisement
Dear colleagues,<\/p>\n
I`m trying to setup a local syslog collector to gather the logs from Fortinet NG firewall. Following the instructions in Azure I installed the syslog agent on Ubuntu, and when I start the diagnostics, it says that is receiving logs on port 514. And then the error is:<\/p>\n
“Error: agent is not listening to incoming port 25266 please check that the process is up and running and the port is configured correctly.”<\/p>\n
I tried to use nestat -an | grep 25266<\/em> , but nothing is returned as result.<\/p>\n Checked the firewall of the machine with sudo ufw status<\/em>, but it says status:inactive<\/p>\n Tried on Ubuntu desktop and Ubuntu server 22.03 with no luck.<\/p>\n There is nothing in MS documentation how to solve this issue.<\/p>\n Did someone faced such configuration issue?<\/p>","upvoteCount":6,"answerCount":4,"datePublished":"2022-07-08T11:03:12.000Z","author":{"@type":"Person","name":"plamenshopov2","url":"https://community.spiceworks.com/u/plamenshopov2"},"suggestedAnswer":[{"@type":"Answer","text":" Dear colleagues,<\/p>\n I`m trying to setup a local syslog collector to gather the logs from Fortinet NG firewall. Following the instructions in Azure I installed the syslog agent on Ubuntu, and when I start the diagnostics, it says that is receiving logs on port 514. And then the error is:<\/p>\n “Error: agent is not listening to incoming port 25266 please check that the process is up and running and the port is configured correctly.”<\/p>\n I tried to use nestat -an | grep 25266<\/em> , but nothing is returned as result.<\/p>\n Checked the firewall of the machine with sudo ufw status<\/em>, but it says status:inactive<\/p>\n Tried on Ubuntu desktop and Ubuntu server 22.03 with no luck.<\/p>\n There is nothing in MS documentation how to solve this issue.<\/p>\n Did someone faced such configuration issue?<\/p>","upvoteCount":6,"datePublished":"2022-07-08T11:03:12.000Z","url":"https://community.spiceworks.com/t/syslog-on-ubuntu-for-azure-sentinel/930614/1","author":{"@type":"Person","name":"plamenshopov2","url":"https://community.spiceworks.com/u/plamenshopov2"}},{"@type":"Answer","text":" if you are using a hardware firewall you should open up that port to that ip adress<\/p>\n notice that syslog is UDP not TCP !!! but you should rather redirect it to TCP 6514 (encrypted)<\/p>","upvoteCount":0,"datePublished":"2022-07-08T11:57:42.000Z","url":"https://community.spiceworks.com/t/syslog-on-ubuntu-for-azure-sentinel/930614/2","author":{"@type":"Person","name":"alainseys3","url":"https://community.spiceworks.com/u/alainseys3"}},{"@type":"Answer","text":" We had the exact same issue and nothing we tried would help, so I’m posting this here in case someone else with the same issue stumbles upon this post like I did.<\/p>\n The Sentinel Fortinet connector page only has instructions for installing the CEF collector agent, but not the OMS agent. Due to this, not only was the agent not working properly, we would have never even figured out that it was missing on our own.<\/p>\n For OMS agent installation instructions go to: Log Analytics Workspace > Agents Management > Linux Servers, or just<\/p>\n eg:
\nwget https://raw.githubusercontent.com/Microsoft/OMS-Agent-for-Linux/master/installer/scripts/onboard_agent.sh<\/a> && sh onboard_agent.sh -w -s -d opinsights.azure.com<\/a><\/p>\n