This ARM template will deploy an Ubuntu Virtual Machine Scale Set to forward Syslog to Microsoft Sentinel using Azure Monitor Agent (AMA). This has been built based on the previous solution we had for CEF with Log Analytics Agent (MMA) CEF-VMSS
The ARM template will deploy everything needed:
- Virtual Machine Scale Set
- Autoscale settings
- Network Security Group
- Virtual Network
- Subnet
- Public IP Address
- Load Balancer
- Data Collection Rule
- Data Colection Rule association
- Managed identity required for AMA to authenticate
The ARM template includes a cloud init to run the required to commands on the VM instances to enable syslog collection.