{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-474-inspect-rsyslog-input-rulesets-when-only-some-sources-reach-azure-monitor-agent/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-474-inspect-rsyslog-input-rulesets-when-only-some-sources-reach-azure-monitor-agent/", "slug": "dse-20260909-474-inspect-rsyslog-input-rulesets-when-only-some-sources-reach-azure-monitor-agent", "url": "https://update.dsesecurity.com/updates/dse-20260909-474-inspect-rsyslog-input-rulesets-when-only-some-sources-reach-azure-monitor-agent/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-474-inspect-rsyslog-input-rulesets-when-only-some-sources-reach-azure-monitor-agent.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-474-inspect-rsyslog-input-rulesets-when-only-some-sources-reach-azure-monitor-agent/" }, "title": "Inspect rsyslog input rulesets when only some sources reach Azure Monitor Agent", "summary": "Can a nondefault rsyslog ruleset bypass the Azure Monitor Agent forwarding path?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:24:02+00:00", "modified_at": "2026-09-10T02:08:05+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 248, "potentially_affected": "Linux Azure Monitor Agent syslog collection through rsyslog inputs bound to nondefault rulesets.", "dse_recommendation": "Trace the affected input's ruleset before changing the DCR or treating every source on the host as equally collected.", "primary_source": { "name": "Troubleshoot the Azure Monitor agent on Linux virtual machines and scale sets - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-troubleshoot-linux-vm", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s Linux Azure Monitor Agent troubleshooting guide states that rsyslog inputs bound to a nondefault ruleset do not forward their messages to AMA. It directs administrators to inspect rsyslog.conf and rsyslog.d, and to confirm that 10-azuremonitoragent.conf is present, nonempty and readable by the syslog user. The agent’s mdsd.qos file provides fifteen-minute processed-event aggregates useful for investigating ingestion drops. Microsoft Learn.

\n

Applicability

\n

Use this branch when selected rsyslog inputs are missing while other host telemetry is available. The guide first calls for checking agent health and the downloaded syslog DCR configuration; this does not replace those prerequisites.

\n

DSE recommendation

\n

Trace the affected input’s ruleset before changing the DCR or treating every source on the host as equally collected. Identify the listener and its explicit routing configuration, then compare it with the intended forwarding path. Keep configuration changes narrowly tied to the missing input and review duplicate-forwarding risk before modifying an existing custom ruleset. Avoid declaring the host fully covered merely because another facility arrives.

\n

Verification

\n

Generate a harmless identifiable test message through the affected input and compare the relevant local processing evidence with the destination result. Use the same time window when inspecting the QoS aggregates, while remembering they summarize events rather than identify each message. Retain the input-to-ruleset mapping and the actual sample outcome. If the message still fails, continue the documented pipeline investigation without claiming the ruleset was the confirmed cause.

\n

Official references

\n

Microsoft Learn: Linux AMA troubleshooting. Source reviewed September 9, 2026.

", "content_text": "Source facts\nMicrosoft’s Linux Azure Monitor Agent troubleshooting guide states that rsyslog inputs bound to a nondefault ruleset do not forward their messages to AMA. It directs administrators to inspect rsyslog.conf and rsyslog.d, and to confirm that 10-azuremonitoragent.conf is present, nonempty and readable by the syslog user. The agent’s mdsd.qos file provides fifteen-minute processed-event aggregates useful for investigating ingestion drops. Microsoft Learn.\nApplicability\nUse this branch when selected rsyslog inputs are missing while other host telemetry is available. The guide first calls for checking agent health and the downloaded syslog DCR configuration; this does not replace those prerequisites.\nDSE recommendation\nTrace the affected input’s ruleset before changing the DCR or treating every source on the host as equally collected. Identify the listener and its explicit routing configuration, then compare it with the intended forwarding path. Keep configuration changes narrowly tied to the missing input and review duplicate-forwarding risk before modifying an existing custom ruleset. Avoid declaring the host fully covered merely because another facility arrives.\nVerification\nGenerate a harmless identifiable test message through the affected input and compare the relevant local processing evidence with the destination result. Use the same time window when inspecting the QoS aggregates, while remembering they summarize events rather than identify each message. Retain the input-to-ruleset mapping and the actual sample outcome. If the message still fails, continue the documented pipeline investigation without claiming the ruleset was the confirmed cause.\nOfficial references\nMicrosoft Learn: Linux AMA troubleshooting. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nMicrosoft’s Linux Azure Monitor Agent troubleshooting guide states that rsyslog inputs bound to a nondefault ruleset do not forward their messages to AMA. It directs administrators to inspect rsyslog.conf and rsyslog.d, and to confirm that 10-azuremonitoragent.conf is present, nonempty and readable by the syslog user. The agent’s mdsd.qos file provides fifteen-minute processed-event aggregates useful for investigating ingestion drops. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-troubleshoot-linux-vm).\n\n## Applicability\n\nUse this branch when selected rsyslog inputs are missing while other host telemetry is available. The guide first calls for checking agent health and the downloaded syslog DCR configuration; this does not replace those prerequisites.\n\n## DSE recommendation\n\nTrace the affected input’s ruleset before changing the DCR or treating every source on the host as equally collected. Identify the listener and its explicit routing configuration, then compare it with the intended forwarding path. Keep configuration changes narrowly tied to the missing input and review duplicate-forwarding risk before modifying an existing custom ruleset. Avoid declaring the host fully covered merely because another facility arrives.\n\n## Verification\n\nGenerate a harmless identifiable test message through the affected input and compare the relevant local processing evidence with the destination result. Use the same time window when inspecting the QoS aggregates, while remembering they summarize events rather than identify each message. Retain the input-to-ruleset mapping and the actual sample outcome. If the message still fails, continue the documented pipeline investigation without claiming the ruleset was the confirmed cause.\n\n## Official references\n\n[Microsoft Learn: Linux AMA troubleshooting](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-troubleshoot-linux-vm). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-474-inspect-rsyslog-input-rulesets-when-only-some-sources-reach-azure-monitor-agent/", "url": "https://update.dsesecurity.com/updates/dse-20260909-474-inspect-rsyslog-input-rulesets-when-only-some-sources-reach-azure-monitor-agent/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-474-inspect-rsyslog-input-rulesets-when-only-some-sources-reach-azure-monitor-agent/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Inspect rsyslog input rulesets when only some sources reach Azure Monitor Agent", "item": "https://update.dsesecurity.com/updates/dse-20260909-474-inspect-rsyslog-input-rulesets-when-only-some-sources-reach-azure-monitor-agent/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-474-inspect-rsyslog-input-rulesets-when-only-some-sources-reach-azure-monitor-agent/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-474-inspect-rsyslog-input-rulesets-when-only-some-sources-reach-azure-monitor-agent/", "url": "https://update.dsesecurity.com/updates/dse-20260909-474-inspect-rsyslog-input-rulesets-when-only-some-sources-reach-azure-monitor-agent/", "headline": "Inspect rsyslog input rulesets when only some sources reach Azure Monitor Agent", "description": "Can a nondefault rsyslog ruleset bypass the Azure Monitor Agent forwarding path?", "abstract": "Can a nondefault rsyslog ruleset bypass the Azure Monitor Agent forwarding path?", "articleBody": "Source facts\nMicrosoft’s Linux Azure Monitor Agent troubleshooting guide states that rsyslog inputs bound to a nondefault ruleset do not forward their messages to AMA. It directs administrators to inspect rsyslog.conf and rsyslog.d, and to confirm that 10-azuremonitoragent.conf is present, nonempty and readable by the syslog user. The agent’s mdsd.qos file provides fifteen-minute processed-event aggregates useful for investigating ingestion drops. Microsoft Learn.\nApplicability\nUse this branch when selected rsyslog inputs are missing while other host telemetry is available. The guide first calls for checking agent health and the downloaded syslog DCR configuration; this does not replace those prerequisites.\nDSE recommendation\nTrace the affected input’s ruleset before changing the DCR or treating every source on the host as equally collected. Identify the listener and its explicit routing configuration, then compare it with the intended forwarding path. Keep configuration changes narrowly tied to the missing input and review duplicate-forwarding risk before modifying an existing custom ruleset. Avoid declaring the host fully covered merely because another facility arrives.\nVerification\nGenerate a harmless identifiable test message through the affected input and compare the relevant local processing evidence with the destination result. Use the same time window when inspecting the QoS aggregates, while remembering they summarize events rather than identify each message. Retain the input-to-ruleset mapping and the actual sample outcome. If the message still fails, continue the documented pipeline investigation without claiming the ruleset was the confirmed cause.\nOfficial references\nMicrosoft Learn: Linux AMA troubleshooting. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:24:02+00:00", "dateModified": "2026-09-10T02:08:05+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-474-inspect-rsyslog-input-rulesets-when-only-some-sources-reach-azure-monitor-agent/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-474-inspect-rsyslog-input-rulesets-when-only-some-sources-reach-azure-monitor-agent/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Inspect rsyslog input rulesets when only some sources reach Azure Monitor Agent" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 248, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Troubleshoot the Azure Monitor agent on Linux virtual machines and scale sets - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-troubleshoot-linux-vm" } } ] } }