Change path on Linux for Azure AMA and CEF Collectors

Question

Jody Spoor 5

I'm setting up Azure Monitoring Agents on Linux with CEF Collector.

I would like to change the cache directories to a separate drive.

Can anyone point me to where these paths are configured?

Pauline Mbabu 1,840 Reputation points Microsoft Employee

2024-10-29T11:53:12.26+00:00

Hello @Jody Spoor ,
I have done research on this and I am not able to find the exact path to the change the cache directories.
I have seen some suggestions that For AMA, you may change the path by modifying the cacheDirectory setting in the agent_settings.json file. The file is usually located at /etc/opt/microsoft/azuremonitoragent/config/agent_settings.json or a similar path depending on your Linux distribution.

For CEF Collector, you may change the path by modifying the cache_path setting in the collector.conf file. The file is usually located at /etc/opt/microsoft/omsagent/conf/omsagent.d/collector.conf or a similar path depending on your Linux distribution.
I have not been able to test this on my end so this is something you can try.
The CEF and Syslog with AMA doc https://learn.microsoft.com/en-us/azure/sentinel/connect-cef-syslog-ama?tabs=portal highlights that to make changes to the syslog config file, locate it at Syslog-ng: /etc/syslog-ng/syslog-ng.conf.

If you are able to get an answer to this kindly share it.
Anthony Edwards 36 Reputation points

2025-11-24T12:25:33.4+00:00

Did you get anywhere with this, I would be interested to know if the above was beneficial?

Your answer

Pauline Mbabu 1,840 Reputation points Microsoft Employee

2024-10-29T11:53:12.26+00:00

Hello @Jody Spoor ,
I have done research on this and I am not able to find the exact path to the change the cache directories.
I have seen some suggestions that For AMA, you may change the path by modifying the cacheDirectory setting in the agent_settings.json file. The file is usually located at /etc/opt/microsoft/azuremonitoragent/config/agent_settings.json or a similar path depending on your Linux distribution.

For CEF Collector, you may change the path by modifying the cache_path setting in the collector.conf file. The file is usually located at /etc/opt/microsoft/omsagent/conf/omsagent.d/collector.conf or a similar path depending on your Linux distribution.
I have not been able to test this on my end so this is something you can try.
The CEF and Syslog with AMA doc https://learn.microsoft.com/en-us/azure/sentinel/connect-cef-syslog-ama?tabs=portal highlights that to make changes to the syslog config file, locate it at Syslog-ng: /etc/syslog-ng/syslog-ng.conf.

If you are able to get an answer to this kindly share it.
Anthony Edwards 36 Reputation points

2025-11-24T12:25:33.4+00:00

Did you get anywhere with this, I would be interested to know if the above was beneficial?