Microsoft Sentinel Shorts

CEF/Syslog Forwarder Event Buffer

All events received from rsyslog or syslog-ng are queued in /var/opt/microsoft/azuremonitoragent/events if they fail to be uploaded.