SyslogAzureMonitorBridge

Windows Service of Syslog listener to send the messages to Azure Monitor

Development environment

Visual Studio (C#)
.NET Framework 4.7.2
Windows Service

Usage

1.Build & Distribute

Open the solution (SyslogAzureMonitorBridge.sln) w/ Visual Studio. Then Build as Release.
To distibute this program, copy the Release folder and paste it to a target windows PC.

2.Register as a Windows Service

Open command prompt Administrator mode. Then exec below command.
sc create SyslogAzureMonitorBridge binpath=<full path name of the SyslogAzureMonitorBridge.exe>

3.Setup your Azure environment

Open windows registry editor (regedit.exe) and find below folder
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SyslogAzureMonitorBridge

Then add command parameter to the ImagePath setting.

Parameter	Description	Example	Remarks
/n=	Table name	Syslog	Actual name in Azure Log Analytics will be "<Table name>_CL"
/p=	Port Number of syslog listener	514	It is necessary to open inbound UDP access with firewall
/w=	Workspace ID		Copy it from Azure Log Analytics screen. See detail below.
/k=	Key		Copy from the same screen of Workspace ID

A sample setting of ImagePath in Windows Registry.

C:\MyApps\Release\SyslogAzureMonitorBridge.exe /n=Syslog /p=514 /w=12345678-1234-1234-1234-123456789012 /k=12345678901234567890123456789012345678901234567890123456789012345678901234567890123456==

NOTE : ImagePath that conatin keys will show on [Task Manager]

To know Azure Monitor ID/Key

Open Log Analytics in Azure Portal of ARM (Azure Resource Manager) then select [1.Advanced Settings] - [2.Connected Sources] - [3.Windows Servers]

Then, copy Workspace ID - [A], Primary Key - [B]
Paste then [A] for /w=, [B] for /k=

4.Start the Service

Exec below command with Windows command prompt administrator mode.

sc start SyslogAzureMonitorBridge

5.Query the syslog with Azure Monitor

This sample is on below settings.
/n=Syslog

Open Log Analytics workspace in Azure Portal (ARM) then click [Logs] command in left pane.

---

Find your Syslog table like below KQL

search * | distinct $table

You will see Syslog_CL in the KQL result if the syslog data have uploaded successfully.

---

Try to see a Syslog_CL data

Syslog_CL
| where EventTime_t > ago(24h)
| limit 20
| order by EventTime_t desc

Record Column

Column	Description
TimeGenerated	Generated time at uploaded to Azure Monitor
EventTime_t	Syslog received time in SyslogAzureMonitorBridge service
Computer	IP address of SyslogAzureMonitorBridge service
Facility_s	Syslog facility
SeverityLevel_s	Syslog severity level
HostIP_s	Syslog owner
HostName_s	Same with HostIP_s column
SyslogMessage_s	Syslog message trimmed start "<priority>" part.