{
    "id": "Syslog",
    "title": "Syslog via Legacy Agent",
    "publisher": "Microsoft",
    "descriptionMarkdown": "Syslog is an event logging protocol that is common to Linux. Applications will send messages that may be stored on the local machine or delivered to a Syslog collector. When the Agent for Linux is installed, it configures the local Syslog daemon to forward messages to the agent. The agent then sends the message to the workspace.\n\n[Learn more >](https://aka.ms/sysLogInfo)",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "Syslog",
            "baseQuery": "Syslog"
        }
    ],
    "sampleQueries": [
        {
            "description": "Last 1000 generated events",
            "query": "Syslog\n            | top 1000 by TimeGenerated"
        },
        {
            "description": "All events by facility except for cron",
            "query": "Syslog\n            | summarize count() by Facility | where Facility != \"cron\""
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "Syslog | extend TimeGenerated = ingestion_time() \n        | where TimeGenerated > ago(7d) \n        | summarize by _ResourceId, bin(TimeGenerated, 1m) \n        | join kind=inner (Heartbeat \n            | where TimeGenerated > ago(7d) \n            | where Category != \"Azure Monitor Agent\" \n            | summarize by _ResourceId, bin(TimeGenerated, 1m)) on _ResourceId, TimeGenerated \n        | summarize LastLogReceived = max(TimeGenerated) \n        | project IsConnected = LastLogReceived > ago(7d) "
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "Syslog",
            "lastDataReceivedQuery": "Syslog\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "write permission is required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "1. Install and onboard the agent for Linux",
            "description": "You can collect Syslog events from your local machine by installing the agent on it. You can also collect Syslog generated on a different source by running the installation script below on the local machine, where the agent is installed.\n\n>  Syslog logs are collected only from **Linux** agents.",
            "instructions": [
                {
                    "parameters": {
                        "title": "Choose where to install the agent:",
                        "instructionSteps": [
                            {
                                "title": "Install agent on Azure Linux Virtual Machine",
                                "description": "Select the machine to install the agent on and then click **Connect**.",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "linkType": "InstallAgentOnLinuxVirtualMachine"
                                        },
                                        "type": "InstallAgent"
                                    }
                                ]
                            },
                            {
                                "title": "Install agent on a non-Azure Linux Machine",
                                "description": "Download the agent on the relevant machine and follow the instructions.",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "linkType": "InstallAgentOnLinuxNonAzure"
                                        },
                                        "type": "InstallAgent"
                                    }
                                ]
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]
        },
        {
            "title": "2. Configure the logs to be collected",
            "description": "Configure the facilities you want to collect and their severities.\n\n1.  Select the link below to open your workspace **agents configuration**, and select the **Syslog** tab.\n2.  Select **Add facility** and choose from the drop-down list of facilities. Repeat for all the facilities you want to add.\n3.  Mark the check boxes for the desired severities for each facility.\n4.  Click **Apply**.",
            "instructions": [
                {
                    "parameters": {
                        "linkType": "OpenSyslogSettings"
                    },
                    "type": "InstallAgent"
                }
            ]
        }
    ]
}