The Beat requires the following three sets of input:
Azure Storage Account Connection String. This string keeps position and state information (what LogRhythm has collected so far from each Event Hub). The Event Hubs beat will use this storage account to create the storage container, if it is not already configured in the Azure portal within this storage account.
The Storage Account Connection String is in the following format:
A list of Event Hub Connection Strings. An Event Hub Connection String must be provided for every Event Hub within the Namespace.
The Event Hub Connection Strings are in the following format:
When you configured the Activity and Diagnostic logs, you selected an Event Hub Namespace. Each type of Azure log creates a new Event Hub within this Namespace. If you configure a new type of Diagnostic log in the future, Azure may create a new Event Hub, and you will need to update the Beat configuration.
A list of Storage Container Names. Each Event Hubs Connection String must have a valid storage container name. If a provided storage container has not been created in the Azure portal within the given storage account, then the storage container will be created with the name provided.
The storage container name may only contain lowercase letters, numbers, and hyphens, and must begin with a letter or a number. Each hyphen must be preceded and followed by a non-hyphen character. The name must also be between 3 and 63 characters long. If a user enters an invalid storage container name, then LRCTL CLI will ask for a valid storage container name again.
Configure Your Firewall
The LogRhythm Event Hub Beat communicates with Azure over the following ports:
- 5671 using the AMQPS protocol
- 443 using the HTTPS protocol
Configure the Storage Account
To configure a storage account for the Azure Event Hubs beat:
- Open the Azure Storage Accounts service.
Select an existing storage account, or create a new storage account by following the steps below.In the Account kind field, LogRhythm recommends that you select StorageV2 (general purpose v2), as Microsoft may deprecate Storage (general purpose v1) in the future.
- To create a new storage account, click on Create.
- In the Subscription field, select Pay-As-You-Go.
- In the Resource group field, select DefaultResourceGroup-CUS or create a new resource group by clicking Create new.
Enter a unique Storage account name.
Leave the Region, Performance, and Redundancy fields set to their defaults.
- Click Review + create.
- Click Create to complete the storage account creation.
In the menu of the selected (or newly created) storage account, click Access keys.
- Copy a connection string from any key and paste it somewhere easily accessible. You will need this key to Initialize the Event Hubs Beat Using Connection Strings.
Configure the Event Hubs
To get an Event Hub Connection String within the Namespace:
- In your Azure Portal, click All Services, Analytics, and then click Event Hubs.
Select the existing Event Hubs Namespace which has been configured to receive activity or diagnostic logs.
The overview opens, showing a list of all Event Hubs in the Namespace.
Click an Event Hub.
The default name of the Activity Log Event Hub is insights-operational-logs. This will be used to populate the value of EntityPath for Event Hub Connection Strings. LogRhythm recommends that you select this Event Hub to start.
You can view metrics such as Messages and Throughput that help determine how much log data is flowing through a particular Event Hub.
Under Settings in the Event Hub menu, click Shared access policies.If no Shared Access Policies exist, you may need to create one. Setting the permissions to Listen is sufficient.
- Select a policy.
In the policy information on the right, copy a connection string, either primary or secondary, and paste it somewhere easily accessible.
Append the following to the end of the connection string. You will need this to Initialize the Event Hubs Beat Using Connection Strings.CODE
When configuring the Event Hub Beat, LogRhythm supports multiple Event Hub Connection Strings.