List Ingestion Delays In Syslog

Description

This KQL query will check for ingestion delays in Syslog by ProcessName, SourceSystem and HostName.

Note: Azure Sentinel scheduled alert rules are delayed by 5 minutes. This allows data types with a smaller delay to be ingested on time for the scheduled run.

Query

Microsoft Sentinel

Syslog
| extend IngestionTime = ingestion_time()
| extend Delay = ingestion_time() - TimeGenerated
| summarize max(Delay) by ProcessName, SourceSystem, HostName

References

• Handle ingestion delay in Microsoft Sentinel | Microsoft Learn
• Handling ingestion delay in Azure Sentinel scheduled alert rules – Microsoft Community Hub