Azure Monitor Agent (mdsd) hit a fatal config error (malformed base64 storage credential in the Data Collection Rule) and crash-looped continuously until the extension was removed from the VM. The DCR itself got corrected 10 minutes later that same day, but agent needed to be reinstalled afterward
Fix applied:
- Reinstalled the Azure Monitor Linux Agent extension (v1.43) on AHA-SYSLOG-01 via Set-AzVMExtension
- It auto-picked up the existing DCR association and correctly reconfigured rsyslog forwarding (10-azuremonitoragent-omfwd.conf ? 127.0.0.1:28330)
- Verified mdsd started clean this time — no repeat of the July 6 crash, active connection between rsyslog and mdsd confirmed
- Verified real CEF traffic (from firewall , facility local7) matches the DCR’s facility filter, so it’ll actually route to CommonSecurityLog rather than being silently dropped
CommonSecurityLog | where TimeGenerated > ago(30m) | where Computer contains “AHA-SYSLOG”