OMS Log Analytics Forwarder Instructions

The OMS Log Analytics Forwarder enables customers to have their OMS managed devices (Windows and Linux) to send data to a central server which has access to the internet. OMS Log Analytics Forwarder is a HTTP forward proxy that support HTTP tunneling via HTTP CONNECT command. The Forwarder can handle up to 1000 OMS concurrent connected devices if run on a 4 core CPU, 8GB Windows Server with a 1Gbps network connection. In order to use the OMS Log Analytics Forwarder, you need to install the OMS agent on the Forwarder Server.

Step 1: Install the OMS agent on the server you are going to install the Forwarder

In order for the OMS Forwarder to know which endpoints it need to talk to you need to install the OMS agent on the server you plan to install the Forwarder.

Follow the instructions here to install the agent . This link will show you how you can install the agent via the UI and via command line.

Note: Please wait for 2-3 minutes after installing the agent to install the OMS Forwarder.

Step 2: Install the OMS Log Analytics Forwarder

Prerequisites: .Net Framework 4.5, Windows Server 2012 R2 SP1 and above

  1. Double click OMS Log Analytics Forwarder.msi to start the installation.
  2. On the Welcome page, click Next.

  1. On the License Agreement page, select I accept the terms in the License Agreement to agree to the EULA and then Next.

  1. On the Port and Proxy Address page, do the following:
  • Type the TCP port number to be used for the forwarder. Setup open this port number from Windows firewall. The default value is 8080. The valid range of the port number is 1 to 65535. If the input does not fall into this range, an error message box will pop up.

  • Input the proxy address where the Gateway needs to connect, if the server on which the Gateway resides needs to go through a proxy. For example, (myorgname.corp.contoso.com:80) This is an optional value. If blank, the Gateway will try to connect to internet directly. Otherwise, the Gateway will connect to through your internal proxy. If your proxy requires authentication, then you can provide a username (domain\user) and password. Note: If you do not provide a domain for the user it will not work.

  • Click “Next”

5. On the Destination Folder page, either leave the default folder %ProgramFiles%\OMS Log Analytics Forwarder or type the location where you want to install forwarder and then click Next.

  1. On the Ready to install page, click install. A User Account Control might appear requesting permission to install. If so, click OK.
  1. After Setup completes, click Finish. You can verify that the service is running by opening the services.msc snap-in and checking for Microsoft OMS Log Analytics Forwarder.

Step 3: Configuring OMS Agents to use the OMS Log Analytics Forwarder to send data

See for information about configuring an agent to use a proxy server, which in this case is the OMS Forwarder.

Troubleshooting the OMS Log Analytics Forwarder

We highly recommend that you install the OMS agent on computers where you install the forwarder. You can then use the agent to collect the events that are logged by the forwarder.

OMS Log Analytics Forwarder Event IDs and Descriptions

Event ID / Description
400 / Any application error that does not have a specific id
401 / Wrong configuration. Eg: listenPort = “haha” instead of an integer
402 / Exception in parsing TLS handshake messages
403 / Networking error. Eg: cannot connect to target server
100 / General information
101 / Service has started
102 / Service has stopped
103 / Received a HTTP CONNECT command from client
104 / Not a HTTP CONNECT command
105 / Destination server is not in allowed list or the destination port is not secure port (443)
106 / In any reason that the TLS session is suspicious and rejected
107 / The TLS session has been verified

Performance Counters to collect

Name / Description
OMS Log Analytics Forwarder\Action Client Connection / Number of active client network (TCP) connections
OMS Log Analytics Forwarder\Connected Client / Number of connected client
OMS Log Analytics Forwarder\Rejection Count / Number of rejections due to any TLS validation error

Uninstalling the OMS Log Analytics Forwarder from Add\Remove program

Supported number of Agent connections

Gateway / Approx. Number of Agents Supported
CPU: Intel Xeon CPU E5-2660 v3 @ 2.6GHz 2 Cores
Memory: 4GB
Network Bandwidth: 1Gbps / 600
CPU: Intel Xeon CPU E5-2660 v3 @ 2.6GHz 4 Cores
Memory: 7GB
Network Bandwidth: 1Gbps / 1000

This support is based on agents uploading ~200KB of data every 6 seconds. The data volume per agent tested is about 2.7GB per day.

Supported Operating System

  • Client SKU: Windows 7, Windows 8.1, Windows 10
  • Server SKU: W2K8 R2, W2012, W2012R2