Skip to content

Installing Azure Log Connector

Azure Log Connector is installed as a Windows service using the provided MSI installation package. The service must be fully configured before it is started for the first time.

Prerequisites:

Before installing, confirm the prerequisites checklist in the Prerequisites for Azure Log Connector article is complete, and that your App Registration in Microsoft Entra ID is fully configured with all required API permissions granted.

Step 1 — Run the installer:

Locate the installation package:

LTA_AzureLogCollector.msi

Right-click the MSI file and select Install. Follow the installation wizard prompts to complete the installation.

By default, the application installs to:

C:Program FilesBlue Lance 2-0LTA_AzureLogCollector

The installation process does not automatically start the LTA_AzureLogCollector Windows service. The service must be configured before it is started for the first time. Do not attempt to start the service until configuration is complete.

Step 2 — Run the configuration utility:

  1. Open Command Prompt or PowerShell as Administrator
  2. Navigate to the installation directory:

cd “C:Program FilesBlue Lance 2-0LTA_AzureLogCollector”

  1. Run the configuration utility:

Lta.Entra.Agent.exe –configure

  1. Enter the following information when prompted:
Prompt Value to Enter
Tenant ID The Directory (tenant) ID from your App Registration
Client ID The Application (client) ID from your App Registration
Client Secret The client secret value generated in your App Registration
AgentId A unique identifier for this collector — defaults to the local machine name
Syslog Host The hostname or IP address of your LT Auditor MP server
Syslog Port The LT Auditor MP syslog listener port — default: 5050
Protocol The syslog transport protocol — UDP, TCP, or TLS — default: TCP

[Your administrator should confirm the correct Syslog Host, Port, and Protocol values for your LT Auditor MP environment before running the configuration utility.]

Step 3 — Start the service:

After configuration is complete, start the Windows service using one of the following methods:

Using the command line:

net start LTA_AzureLogCollector

Using the Services console:

  1. Open Services (services.msc)
  2. Locate LT Auditor MP Azure Log Collector
  3. Click Start

Step 4 — Verify the service is running:

Confirm the service started successfully:

sc query LTA_AzureLogCollector

The service should show as Running. If the service fails to start, review the application logs for errors:

C:Program FilesBlue Lance 2-0LTA_AzureLogCollectorlogs

Check for:

  • Authentication failures — confirm Tenant ID, Client ID, and Client Secret are correct
  • API permission errors — confirm Admin Consent has been granted for all permissions
  • Network connectivity issues — confirm outbound HTTPS access to Microsoft API endpoints
  • Syslog connection errors — confirm the LT Auditor MP server is reachable on the configured port

Step 5 — Verify events are arriving in LT Auditor MP:

After the service starts successfully:

  1. Allow at least one polling cycle to complete (default: 5 minutes)
  2. Log in to the LT Auditor MP Web UI
  3. Navigate to View
  4. Select the Azure Log Connector environment and category
  5. Set the date range to Last Hour
  6. Confirm that Azure log events are appearing in the event list

If no events appear after several polling cycles, refer to the verification and troubleshooting steps in the Configuring Polling Settings article.