Microsoft Security | Microsoft Sentinel
A cloud-native SIEM solution that provides intelligent security analytics and threat detection across systems
SecurityEvent logs not ingesting into Sentinel
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 42%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EN%3C/text%3E%3C/svg%3E)
Norah
20
Reputation points
SecurityEvent logs are not getting ingested into Sentinel, but heartbeat and ASimDNS logs are coming from the same server. Logging is happening on the servers Event viewer.
The log ingestion starts again automatically after a few days. Could you please help us check this issue? Also, please share any documentation on how to review AMA logs for troubleshooting.
Microsoft Security | Microsoft Sentinel
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 90%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPM%3C/text%3E%3C/svg%3E)
Pauline Mbabu 1,840 Reputation points Microsoft Employee2025-11-03T10:42:51.85+00:00 Hello @Norah ,
Is this still happening? I would recommend creating a support ticket so that we find out if there is an Issue with the AMA agent. https://learn.microsoft.com/en-us/mem/get-supportHowever, here is the troubleshooting guide: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/troubleshooter-ama-windows?tabs=WindowsPowerShell
Sign in to comment
Sign in to answer