Document: Options to Send AWS EC2
Syslog to Azure Sentinel
Overview
This document describes two common approaches to collect and forward syslog data
from AWS EC2 instances into Azure Sentinel for centralized monitoring and analysis.
Option 1: Direct Ingestion via Azure Arc + Azure Monitor
Agent (AMA)
Architecture
Description
● Install Azure Connected Machine agent (Azure Arc agent) on each AWS EC2
instance.
● Register EC2 instances as Azure Arc-enabled servers.
● Deploy Azure Monitor Agent (AMA) on EC2 via Azure Arc.
● Configure Data Collection Rules (DCR) to collect syslog and other logs.
● Logs flow directly from EC2 instances to Azure Sentinel via the Log Analytics
workspace.
Benefits
● Native Azure integration with centralized management.
● No need for intermediate log collectors.
● Supports collecting syslog, performance metrics, and custom logs.
● Leverages Azure Arc to manage hybrid and multi-cloud resources uniformly.
Steps
1. Onboard AWS EC2 instances to Azure Arc.
2. Deploy Azure Monitor Agent on EC2 through Azure Arc.
3. Create and assign Data Collection Rules for syslog.
4. Verify log ingestion in Azure Sentinel via Kusto queries.
Option 2: Syslog Forwarding through an Azure Collector
Server
Architecture
Description
● Deploy a Linux VM in Azure as a central syslog collector.
● Configure syslog-ng or rsyslog on Azure VM to receive syslog messages over
UDP/TCP from AWS EC2 instances.
● Configure EC2 instances’ syslog clients to forward syslog messages to the Azure
collector.
● Install Azure Monitor Agent on the Azure collector VM.
● Configure Data Collection Rules (DCR) on the collector VM to send collected
syslog data to Azure Sentinel.
Benefits
● Centralized syslog collection point for multiple devices.
● Can aggregate syslogs from EC2 instances, firewalls, and other network devices.
● Useful if you want to manage logs before forwarding to Sentinel.
● Supports custom log processing or filtering at the collector.
Steps
1. Deploy and configure syslog-ng or rsyslog on Azure Linux VM.
2. Enable syslog forwarding on AWS EC2 instances to Azure collector.
3. Install Azure Monitor Agent on the Azure collector VM.
4. Configure Data Collection Rules to collect syslog files.
5. Verify log ingestion in Azure Sentinel.
Verification and Analysis
● Use Azure Sentinel Logs and Kusto Query Language (KQL) queries to validate
data ingestion and analyze syslog data.
● Example query to view syslog entries from a machine:
Syslog
| where Computer == "<MachineName>"
| order by TimeGenerated desc
| take 50
Summary
Feature Option 1: Direct Azure Arc + Option 2: Azure Collector Server
AMA
On-premises or AWS EC2 directly Central Azure VM as syslog
cloud aggregator
Complexity Lower (no intermediate Higher (requires additional Azure
server) VM setup)
Scalability Scales per EC2 instance Centralized point for multiple
devices
Management Managed via Azure Arc Managed via Azure VM and syslog
config
Use cases Hybrid/multi-cloud unified Aggregation of syslogs, network
monitoring devices, firewalls