Which of the following would you query for events from Linux system logging?

A company has deployed several applications across Windows and Linux Virtual machines in Azure. Log Analytics are being used to send the required data for alerting purposes for the Virtual Machines.

You need to recommend which tables need to be queried for security related queries.

Which of the following would you query for events from Linux system logging?
A . Azure Activity
B . Azure Diagnostics
C . Event
D . Syslog

View Answer

Answer: D

Explanation:

This is also given in the Microsoft documentation, wherein you would use the Syslog Table for the queries on events from Linux Virtual machines

Note: Syslog is an event logging protocol that is common to Linux. Applications will send messages that may be stored on the local machine or delivered to a Syslog collector. When the Log Analytics agent for Linux is installed, it configures the local Syslog daemon to forward messages to the agent. The agent then sends the message to Azure Monitor where a corresponding record is created.

Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-syslog