Installing Azure Log Connector

Azure Log Connector is installed as a Windows service using the provided MSI installation package. The service must be fully configured before it is started for the first time.

---

Prerequisites:

Before installing, confirm the prerequisites checklist in the Prerequisites for Azure Log Connector article is complete, and that your App Registration in Microsoft Entra ID is fully configured with all required API permissions granted.

---

Step 1 — Run the installer:

Locate the installation package:

LTA_AzureLogCollector.msi

Right-click the MSI file and select Install. Follow the installation wizard prompts to complete the installation.

By default, the application installs to:

C:\Program Files\Blue Lance 2-0\LTA_AzureLogCollector

The installation process does not automatically start the LTA_AzureLogCollector Windows service. The service must be configured before it is started for the first time. Do not attempt to start the service until configuration is complete.

---

Step 2 — Run the configuration utility:

1. Open Command Prompt or PowerShell as Administrator
2. Navigate to the installation directory:

cd “C:\Program Files\Blue Lance 2-0\LTA_AzureLogCollector”

3. Run the configuration utility:

Lta.Entra.Agent.exe –configure

4. Enter the following information when prompted:

Prompt	Value to Enter
Tenant ID	The Directory (tenant) ID from your App Registration
Client ID	The Application (client) ID from your App Registration
Client Secret	The client secret value generated in your App Registration
AgentId	A unique identifier for this collector — defaults to the local machine name
Syslog Host	The hostname or IP address of your LT Auditor MP server
Syslog Port	The LT Auditor MP syslog listener port — default: 5050
Protocol	The syslog transport protocol — UDP, TCP, or TLS — default: TCP

[Your administrator should confirm the correct Syslog Host, Port, and Protocol values for your LT Auditor ^MP environment before running the configuration utility.]

---

Step 3 — Start the service:

After configuration is complete, start the Windows service using one of the following methods:

Using the command line:

net start LTA_AzureLogCollector

Using the Services console:

1. Open Services (services.msc)
2. Locate LT Auditor ^MP Azure Log Collector
3. Click Start

---

Step 4 — Verify the service is running:

Confirm the service started successfully:

sc query LTA_AzureLogCollector

The service should show as Running. If the service fails to start, review the application logs for errors:

C:\Program Files\Blue Lance 2-0\LTA_AzureLogCollector\logs

Check for:

• Authentication failures — confirm Tenant ID, Client ID, and Client Secret are correct
• API permission errors — confirm Admin Consent has been granted for all permissions
• Network connectivity issues — confirm outbound HTTPS access to Microsoft API endpoints
• Syslog connection errors — confirm the LT Auditor ^MP server is reachable on the configured port

---

Step 5 — Verify events are arriving in LT Auditor ^MP:

After the service starts successfully:

1. Allow at least one polling cycle to complete (default: 5 minutes)
2. Log in to the LT Auditor ^MP Web UI
3. Navigate to View
4. Select the Azure Log Connector environment and category
5. Set the date range to Last Hour
6. Confirm that Azure log events are appearing in the event list

If no events appear after several polling cycles, refer to the verification and troubleshooting steps in the Configuring Polling Settings article.