-
Title
Azure Sentinel Logs Stop Sending -
Description
Logs stop sending to Azure Sentinel occasionally and do not start sending again until the Syslog-ng service is restarted on the SSB (Syslog-ng Store Box). -
Cause
The timeout option was never configured and therefore does not try to initiate a reconnect after Azure Sentinel initiates a disconnect.
Azure Sentinel can issue a disconnect while Microsoft is moving data centers, maintenance is being done, or during an outage.
By default the timeout value is 0 which is disabled and therefore a reconnect will not be attempted. -
Resolution
Please set the timeout value to 30 seconds or more, depending on the needs of the environment.
One Identity support recommends a timeout value of 60 seconds to start, and if the issue reoccurs, setting the timeout value even higher until the issue no longer exists.
The timeout value can be found by logging into the SSB's WebUI, and then navigating to Log > Destinations, and then locate the destination in question and apply the change. Please see the below screenshot for where to set the value:
For more information on the timeout value please see the timeout option within the administrative guide for the SSB being run within the environment.