Sumo Config

1. Sign-In to Platform
2. Go to Data Management
3. Add Collection

Type Hosted Collector (Sumo Cloud)

1. Now, Inside the Collection add Source as HTTP Logs and Metrics
   • Copy Enpoint

     • Header - x-sumo-token: ZaVnC4dhaV3m0rN4

     • Endpoint - https://endpoint4.collection.sumologic.com/receiver/v1/http

2. Most Imp, Now Go to Source -> Advance Option for Log and Disable Message Processing

Type Installed Collector (VM)

1. Now, Inside the Collection add Source as Installed Collector
2. Run the Script Shown on Sumo UI
3. Give chmod 0777 to script and run it
4. Select Access Token (Administration -> Account Security Settings -> Installation Token -> Generate New)
5. Device will Automatically Added
6. Add Source as Rsyslog
7. Make Sure in VM UDP 514 Port is Enabled and Recieving Alerts (. @127.0.0.1:1514)

Rsyslog Configs

• Rsyslog Config Folder (cd /etc/rsyslog.d)
• Create a New Config (nano /etc/rsyslog.d/60-sumo-forward.conf)
• Add (. @127.0.0.1:1514)