Windows diagnostics extension schema

مقالة
09/11/2024

Azure Diagnostics extension is an agent in Azure Monitor that collects monitoring data from the guest operating system and workloads of Azure compute resources. This article details the schema used for configuration of the diagnostics extension on Windows virtual machines and other compute resources.

Note

The schema in this article is valid for versions 1.3 and newer (Azure SDK 2.4 and newer). Newer configuration sections are commented to show in what version they were added. Version 1.0 and 1.2 of the schema have been archived and no longer available.

Public configuration file schema

Download the public configuration file schema definition by executing the following PowerShell command:

(Get-AzureServiceAvailableExtension -ExtensionName 'PaaSDiagnostics' -ProviderNamespace 'Microsoft.Azure.Diagnostics').PublicConfigurationSchema | Out-File –Encoding utf8 -FilePath 'C:\temp\WadConfig.xsd'

Common Attribute Types

scheduledTransferPeriod attribute appears in several elements. It is the interval between scheduled transfers to storage rounded up to the nearest minute. The value is an XML “Duration Data Type.”

DiagnosticsConfiguration Element

Tree: Root - DiagnosticsConfiguration

Added in version 1.3.

The top-level element of the diagnostics configuration file.

Attribute xmlns - The XML namespace for the diagnostics configuration file is:
http://schemas.microsoft.com/ServiceHosting/2010/10/DiagnosticsConfiguration

Child Elements	Description
PublicConfig	Required. See description elsewhere on this page.
PrivateConfig	Optional. See description elsewhere on this page.
IsEnabled	Boolean. See description elsewhere on this page.

PublicConfig Element

Tree: Root - DiagnosticsConfiguration - PublicConfig

Describes the public diagnostics configuration.

Child Elements	Description
WadCfg	Required. See description elsewhere on this page.
StorageAccount	The name of the Azure Storage account to store the data in. May also be specified as a parameter when executing the Set-AzureServiceDiagnosticsExtension cmdlet.
StorageType	Can be Table, Blob, or TableAndBlob. Table is default. When TableAndBlob is chosen, diagnostic data is written twice -- once to each type.
LocalResourceDirectory	The directory on the virtual machine where the Monitoring Agent stores event data. If not, set, the default directory is used: For a Worker/web role: `C:\Resources\<guid>\directory\<guid>.<RoleName.DiagnosticStore\` For a Virtual Machine: `C:\WindowsAzure\Logs\Plugins\Microsoft.Azure.Diagnostics.IaaSDiagnostics\<WADVersion>\WAD<WADVersion>` Required attributes are: - path - The directory on the system to be used by Azure Diagnostics. - expandEnvironment - Controls whether environment variables are expanded in the path name.

WadCFG Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG

Identifies and configures the telemetry data to be collected.

DiagnosticMonitorConfiguration Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - DiagnosticMonitorConfiguration

Required

Attributes	Description
overallQuotaInMB	The maximum amount of local disk space that may be consumed by the various types of diagnostic data collected by Azure Diagnostics. The default setting is 4096 MB.
useProxyServer	Configure Azure Diagnostics to use the proxy server settings as set in Internet Explorer settings.
sinks	Added in 1.5. Optional. Points to a sink location to also send diagnostic data for all child elements that support sinks. Sink example is Application Insights or Event Hubs. Note you need to add the resourceId property under the Metrics element if you want events uploaded to Event Hubs to have a resource ID.

Child Elements	Description
CrashDumps	See description elsewhere on this page.
DiagnosticInfrastructureLogs	Enable collection of logs generated by Azure Diagnostics. The diagnostic infrastructure logs are useful for troubleshooting the diagnostics system itself. Optional attributes are: - scheduledTransferLogLevelFilter - Configures the minimum severity level of the logs collected. - scheduledTransferPeriod - The interval between scheduled transfers to storage rounded up to the nearest minute. The value is an XML “Duration Data Type.”
Directories	See description elsewhere on this page.
EtwProviders	See description elsewhere on this page.
Metrics	See description elsewhere on this page.
PerformanceCounters	See description elsewhere on this page.
WindowsEventLog	See description elsewhere on this page.
DockerSources	See description elsewhere on this page.

CrashDumps Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - DiagnosticMonitorConfiguration - CrashDumps

Enable the collection of crash dumps.

Attributes	Description
containerName	Optional. The name of the blob container in your Azure Storage account to be used to store crash dumps.
crashDumpType	Optional. Configures Azure Diagnostics to collect mini or full crash dumps.
directoryQuotaPercentage	Optional. Configures the percentage of overallQuotaInMB to be reserved for crash dumps on the VM.

Child Elements	Description
CrashDumpConfiguration	Required. Defines configuration values for each process. The following attribute is also required: processName - The name of the process you want Azure Diagnostics to collect a crash dump for.

Directories Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - DiagnosticMonitorConfiguration - Directories

Enables the collection of the contents of a directory, IIS failed access request logs and/or IIS logs.

Optional scheduledTransferPeriod attribute. See explanation earlier.

Child Elements	Description
IISLogs	Including this element in the configuration enables the collection of IIS logs: containerName - The name of the blob container in your Azure Storage account to be used to store the IIS logs.
FailedRequestLogs	Including this element in the configuration enables collection of logs about failed requests to an IIS site or application. You must also enable tracing options under system.WebServer in Web.config.
DataSources	A list of directories to monitor.

DataSources Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - DiagnosticMonitorConfiguration - Directories - DataSources

A list of directories to monitor.

Child Elements	Description
DirectoryConfiguration	Required. Required attribute: containerName - The name of the blob container in your Azure Storage account that to be used to store the log files.

DirectoryConfiguration Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - DiagnosticMonitorConfiguration - Directories - DataSources - DirectoryConfiguration

May include either the Absolute or LocalResource element but not both.

Child Elements	Description
Absolute	The absolute path to the directory to monitor. The following attributes are required: - Path - The absolute path to the directory to monitor. - expandEnvironment - Configures whether environment variables in Path are expanded.
LocalResource	The path relative to a local resource to monitor. Required attributes are: - Name - The local resource that contains the directory to monitor - relativePath - The path relative to Name that contains the directory to monitor

EtwProviders Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - DiagnosticMonitorConfiguration - EtwProviders

Configures collection of ETW events from EventSource and/or ETW Manifest based providers.

Child Elements	Description
EtwEventSourceProviderConfiguration	Configures collection of events generated from EventSource Class. Required attribute: provider - The class name of the EventSource event. Optional attributes are: - scheduledTransferLogLevelFilter - The minimum severity level to transfer to your storage account. - scheduledTransferPeriod - The interval between scheduled transfers to storage rounded up to the nearest minute. The value is an XML “Duration Data Type.”
EtwManifestProviderConfiguration	Required attribute: provider - The GUID of the event provider Optional attributes are: - scheduledTransferLogLevelFilter - The minimum severity level to transfer to your storage account. - scheduledTransferPeriod - The interval between scheduled transfers to storage rounded up to the nearest minute. The value is an XML “Duration Data Type.”

Child Elements

Description

EtwEventSourceProviderConfiguration

Configures collection of events generated from EventSource Class. Required attribute:

provider - The class name of the EventSource event.

Optional attributes are:

- scheduledTransferLogLevelFilter - The minimum severity level to transfer to your storage account.

- scheduledTransferPeriod - The interval between scheduled transfers to storage rounded up to the nearest minute. The value is an XML “Duration Data Type.”

EtwManifestProviderConfiguration

Required attribute:

provider - The GUID of the event provider

Optional attributes are:

- scheduledTransferLogLevelFilter - The minimum severity level to transfer to your storage account.

- scheduledTransferPeriod - The interval between scheduled transfers to storage rounded up to the nearest minute. The value is an XML “Duration Data Type.”

EtwEventSourceProviderConfiguration Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - DiagnosticMonitorConfiguration - EtwProviders- EtwEventSourceProviderConfiguration

Configures collection of events generated from EventSource Class.

Child Elements	Description
DefaultEvents	Optional attribute: eventDestination - The name of the table to store the events in
Event	Required attribute: id - The id of the event. Optional attribute: eventDestination - The name of the table to store the events in

EtwManifestProviderConfiguration Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - DiagnosticMonitorConfiguration - EtwProviders - EtwManifestProviderConfiguration

Child Elements	Description
DefaultEvents	Optional attribute: eventDestination - The name of the table to store the events in
Event	Required attribute: id - The id of the event. Optional attribute: eventDestination - The name of the table to store the events in

Metrics Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - DiagnosticMonitorConfiguration - Metrics

Enables you to generate a performance counter table that is optimized for fast queries. Each performance counter that is defined in the PerformanceCounters element is stored in the Metrics table in addition to the Performance Counter table.

The resourceId attribute is required. The resource ID of the Virtual Machine or Virtual Machine Scale Set you are deploying Azure Diagnostics to. Get the resourceID from the Azure portal. Select Browse -> Resource Groups -> <Name>. Click the Properties tile and copy the value from the ID field. This resourceID property is used for both sending custom metrics and for adding a resourceID property to data sent to Event Hubs. Note you need to add the resourceId property under the Metrics element if you want events uploaded to Event Hubs to have a resource ID.

Child Elements	Description
MetricAggregation	Required attribute: scheduledTransferPeriod - The interval between scheduled transfers to storage rounded up to the nearest minute. The value is an XML “Duration Data Type.”

PerformanceCounters Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - DiagnosticMonitorConfiguration - PerformanceCounters

Enables the collection of performance counters.

Optional attribute:

Optional scheduledTransferPeriod attribute. See explanation earlier.

Child Element Description

PerformanceCounterConfiguration The following attributes are required:

- counterSpecifier - The name of the performance counter. For example, \Processor(_Total)\% Processor Time. To get a list of performance counters on your host, run the command typeperf.

- sampleRate - How often the counter should be sampled.

Optional attribute:

unit - The unit of measure of the counter. Values are available at UnitType Class

sinks Added in 1.5. Optional. Points to a sink location to also send diagnostic data. For example, Azure Monitor or Event Hubs. Note you need to add the resourceId property under the Metrics element if you want events uploaded to Event Hubs to have a resource ID.

Child Element	Description
PerformanceCounterConfiguration	The following attributes are required: - counterSpecifier - The name of the performance counter. For example, `\Processor(_Total)\% Processor Time`. To get a list of performance counters on your host, run the command `typeperf`. - sampleRate - How often the counter should be sampled. Optional attribute: unit - The unit of measure of the counter. Values are available at UnitType Class
sinks	Added in 1.5. Optional. Points to a sink location to also send diagnostic data. For example, Azure Monitor or Event Hubs. Note you need to add the resourceId property under the Metrics element if you want events uploaded to Event Hubs to have a resource ID.

WindowsEventLog Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - DiagnosticMonitorConfiguration - WindowsEventLog

Enables the collection of Windows Event Logs.

Optional scheduledTransferPeriod attribute. See explanation earlier.

Child Element	Description
DataSource	The Windows Event logs to collect. Required attribute: name - The XPath query describing the Windows events to be collected. For example: `Application![System[(Level <=3)]], System![System[(Level <=3)]], System![System[Provider[@Name='Microsoft Antimalware']]], Security![System[(Level <= 3)]` To collect all events, specify "*"
sinks	Added in 1.5. Optional. Points to a sink location to also send diagnostic data for all child elements that support sinks. Sink example is Application Insights or Event Hubs.

Logs Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - DiagnosticMonitorConfiguration - Logs

Present in version 1.0 and 1.1. Missing in 1.2. Added back in 1.3.

Defines the buffer configuration for basic Azure logs.

Attribute	Type	Description
bufferQuotaInMB	unsignedInt	Optional. Specifies the maximum amount of file system storage that is available for the specified data. The default is 0.
scheduledTransferLogLevelFilter	string	Optional. Specifies the minimum severity level for log entries that are transferred. The default value is Undefined, which transfers all logs. Other possible values (in order of most to least information) are Verbose, Information, Warning, Error, and Critical.
scheduledTransferPeriod	duration	Optional. Specifies the interval between scheduled transfers of data, rounded up to the nearest minute. The default is PT0S.
sinks	string	Added in 1.5. Optional. Points to a sink location to also send diagnostic data. For example, Application Insights or Event Hubs. Note you need to add the resourceId property under the Metrics element if you want events uploaded to Event Hubs to have a resource ID.

DockerSources

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - DiagnosticMonitorConfiguration - DockerSources

Added in 1.9.

Element Name	Description
Stats	Tells the system to collect stats for Docker containers

SinksConfig Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - SinksConfig

A list of locations to send diagnostics data to and the configuration associated with those locations.

Element Name	Description
Sink	See description elsewhere on this page.

Sink Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - SinksConfig - Sink

Added in version 1.5.

Defines locations to send diagnostic data to. For example, the Application Insights service.

Attribute	Type	Description
name	string	A string identifying the sinkname.

Element	Type	Description
Application Insights	string	Used only when sending data to Application Insights. Contain the Instrumentation Key for an active Application Insights account that you have access to.
Channels	string	One for each additional filtering that stream that you

Channels Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - SinksConfig - Sink - Channels

Added in version 1.5.

Defines filters for streams of log data passing through a sink.

Element	Type	Description
Channel	string	See description elsewhere on this page.

Channel Element

Tree: Root - DiagnosticsConfiguration - PublicConfig - WadCFG - SinksConfig - Sink - Channels - Channel

Added in version 1.5.

Defines locations to send diagnostic data to. For example, the Application Insights service.

Attributes	Type	Description
logLevel	string	Specifies the minimum severity level for log entries that are transferred. The default value is Undefined, which transfers all logs. Other possible values (in order of most to least information) are Verbose, Information, Warning, Error, and Critical.
name	string	A unique name of the channel to refer to

PrivateConfig Element

Tree: Root - DiagnosticsConfiguration - PrivateConfig

Added in version 1.3.

Optional

Stores the private details of the storage account (name, key, and endpoint). This information is sent to the virtual machine, but cannot be retrieved from it.

Child Elements	Description
StorageAccount	The storage account to use. The following attributes are required - name - The name of the storage account. - key - The key to the storage account. - endpoint - The endpoint to access the storage account. -sasToken (added 1.8.1)- You can specify an SAS token instead of a storage account key in the private config. If provided, the storage account key is ignored. Requirements for the SAS Token: - Supports account SAS token only - b, t service types are required. - a, c, u, w permissions are required. - c, o resource types are required. - Supports the HTTPS protocol only - Start and expiry time must be valid.

Child Elements

Description

StorageAccount

The storage account to use. The following attributes are required

- name - The name of the storage account.

- key - The key to the storage account.

- endpoint - The endpoint to access the storage account.

-sasToken (added 1.8.1)- You can specify an SAS token instead of a storage account key in the private config. If provided, the storage account key is ignored.
Requirements for the SAS Token:
- Supports account SAS token only
- b, t service types are required.
- a, c, u, w permissions are required.
- c, o resource types are required.
- Supports the HTTPS protocol only
- Start and expiry time must be valid.

IsEnabled Element

Tree: Root - DiagnosticsConfiguration - IsEnabled

Boolean. Use true to enable the diagnostics or false to disable the diagnostics.

Example configuration

Following is a complete sample configuration for Windows diagnostics extension shown in both JSON and XML.

JSON

The PublicConfig and PrivateConfig are separated because in most JSON usage cases, they are passed as different variables. These cases include Resource Manager templates, PowerShell, and Visual Studio.

Note

The public config Azure Monitor sink definition has two properties, resourceId and region. These are only required for Classic VMs and Classic Cloud services. The region property should not be used for other resources, the resourceId property is used on ARM VMs to populate the resourceID field in logs uploaded to Event Hubs.

"PublicConfig" {
    "WadCfg": {
        "DiagnosticMonitorConfiguration": {
            "overallQuotaInMB": 10000,
            "DiagnosticInfrastructureLogs": {
                "scheduledTransferLogLevelFilter": "Error"
            },
            "PerformanceCounters": {
                "scheduledTransferPeriod": "PT1M",
                "sinks": "AzureMonitorSink",
                "PerformanceCounterConfiguration": [
                    {
                        "counterSpecifier": "\\Processor(_Total)\\% Processor Time",
                        "sampleRate": "PT1M",
                        "unit": "percent"
                    }
                ]
            },
            "Directories": {
                "scheduledTransferPeriod": "PT5M",
                "IISLogs": {
                    "containerName": "iislogs"
                },
                "FailedRequestLogs": {
                    "containerName": "iisfailed"
                },
                "DataSources": [
                    {
                        "containerName": "mynewprocess",
                        "Absolute": {
                            "path": "C:\\MyNewProcess",
                            "expandEnvironment": false
                        }
                    },
                    {
                        "containerName": "badapp",
                        "Absolute": {
                            "path": "%SYSTEMDRIVE%\\BadApp",
                            "expandEnvironment": true
                        }
                    },
                    {
                        "containerName": "goodapp",
                        "LocalResource": {
                            "relativePath": "..\\PeanutButter",
                            "name": "Skippy"
                        }
                    }
                ]
            },
            "EtwProviders": {
                "sinks": "",
                "EtwEventSourceProviderConfiguration": [
                    {
                        "scheduledTransferPeriod": "PT5M",
                        "provider": "MyProviderClass",
                        "Event": [
                            {
                                "id": 0
                            },
                            {
                                "id": 1,
                                "eventDestination": "errorTable"
                            }
                        ],
                        "DefaultEvents": {
                        }
                    }
                ],
                "EtwManifestProviderConfiguration": [
                    {
                        "scheduledTransferPeriod": "PT2M",
                        "scheduledTransferLogLevelFilter": "Information",
                        "provider": "5974b00b-84c2-44bc-9e58-3a2451b4e3ad",
                        "Event": [
                            {
                                "id": 0
                            }
                        ],
                        "DefaultEvents": {
                        }
                    }
                ]
            },
            "WindowsEventLog": {
                "scheduledTransferPeriod": "PT5M",
                "DataSource": [
                    {
                        "name": "System!*[System[Provider[@Name='Microsoft Antimalware']]]"
                    },
                    {
                        "name": "System!*[System[Provider[@Name='NTFS'] and (EventID=55)]]"
                    },
                    {
                        "name": "System!*[System[Provider[@Name='disk'] and (EventID=7 or EventID=52 or EventID=55)]]"
                    }
                ]
            },
            "Logs": {
                "scheduledTransferPeriod": "PT1M",
                "scheduledTransferLogLevelFilter": "Verbose",
                "sinks": "ApplicationInsights.AppLogs"
            },
            "CrashDumps": {
                "directoryQuotaPercentage": 30,
                "dumpType": "Mini",
                "containerName": "wad-crashdumps",
                "CrashDumpConfiguration": [
                    {
                        "processName": "mynewprocess.exe"
                    },
                    {
                        "processName": "badapp.exe"
                    }
                ]
            }
        },
        "SinksConfig": {
            "Sink": [
                {
                    "name": "AzureMonitorSink",
                    "AzureMonitor":
                    {
                        "ResourceId": "{insert resourceId if a classic VM or cloud service, else property not needed}",
                        "Region": "{insert Azure region of resource if a classic VM or cloud service, else property not needed}"
                    }
                },
                {
                    "name": "ApplicationInsights",
                    "ApplicationInsights": "{Insert InstrumentationKey}",
                    "Channels": {
                        "Channel": [
                            {
                                "logLevel": "Error",
                                "name": "Errors"
                            },
                            {
                                "logLevel": "Verbose",
                                "name": "AppLogs"
                            }
                        ]
                    }
                },
                {
                    "name": "EventHub",
                    "EventHub": {
                        "Url": "https://myeventhub-ns.servicebus.windows.net/diageventhub",
                        "SharedAccessKeyName": "SendRule",
                        "usePublisherId": false
                    }
                },
                {
                    "name": "secondaryEventHub",
                    "EventHub": {
                        "Url": "https://myeventhub-ns.servicebus.windows.net/secondarydiageventhub",
                        "SharedAccessKeyName": "SendRule",
                        "usePublisherId": false
                    }
                },
                {
                    "name": "secondaryStorageAccount",
                    "StorageAccount": {
                        "name": "secondarydiagstorageaccount",
                        "endpoint": "https://core.windows.net"
                    }
                }
            ]
        }
    },
    "StorageAccount": "diagstorageaccount",
    "StorageType": "TableAndBlob"
}

Note

The private config Azure Monitor sink definition has two properties, PrincipalId and Secret. These are only required for Classic VMs and Classic Cloud services. These properties should not be used for other resources.

"PrivateConfig" {
    "storageAccountName": "diagstorageaccount",
    "storageAccountKey": "{base64 encoded key}",
    "storageAccountEndPoint": "https://core.windows.net",
    "storageAccountSasToken": "{sas token}",
    "EventHub": {
        "Url": "https://myeventhub-ns.servicebus.windows.net/diageventhub",
        "SharedAccessKeyName": "SendRule",
        "SharedAccessKey": "{base64 encoded key}"
    },
    "AzureMonitorAccount": {
        "ServicePrincipalMeta": {
            "PrincipalId": "{Insert service principal client Id}",
            "Secret": "{Insert service principal client secret}"
        }
    },
    "SecondaryStorageAccounts": {
        "StorageAccount": [
            {
                "name": "secondarydiagstorageaccount",
                "key": "{base64 encoded key}",
                "endpoint": "https://core.windows.net",
                "sasToken": "{sas token}"
            }
        ]
    },
    "SecondaryEventHubs": {
        "EventHub": [
            {
                "Url": "https://myeventhub-ns.servicebus.windows.net/secondarydiageventhub",
                "SharedAccessKeyName": "SendRule",
                "SharedAccessKey": "{base64 encoded key}"
            }
        ]
    }
}

XML

<?xml version="1.0" encoding="utf-8"?>  
<DiagnosticsConfiguration  xmlns="http://schemas.microsoft.com/ServiceHosting/2010/10/DiagnosticsConfiguration">   
  <PublicConfig>  
    <WadCfg>  
      <DiagnosticMonitorConfiguration overallQuotaInMB="10000">  

        <PerformanceCounters scheduledTransferPeriod="PT1M" sinks="AzureMonitorSink">  
          <PerformanceCounterConfiguration counterSpecifier="\Processor(_Total)\% Processor Time" sampleRate="PT1M" unit="percent" />  
        </PerformanceCounters>  

        <Directories scheduledTransferPeriod="PT5M">  
          <IISLogs containerName="iislogs" />  
          <FailedRequestLogs containerName="iisfailed" />  

          <DataSources>  
            <DirectoryConfiguration containerName="mynewprocess">  
              <Absolute path="C:\MyNewProcess" expandEnvironment="false" />  
            </DirectoryConfiguration>  
            <DirectoryConfiguration containerName="badapp">  
              <Absolute path="%SYSTEMDRIVE%\BadApp" expandEnvironment="true" />  
            </DirectoryConfiguration>  
            <DirectoryConfiguration containerName="goodapp">  
              <LocalResource name="Skippy" relativePath="..\PeanutButter"/>  
            </DirectoryConfiguration>  
          </DataSources>  

        </Directories>  

        <EtwProviders>  
          <EtwEventSourceProviderConfiguration   
                       provider="MyProviderClass"   
                       scheduledTransferPeriod="PT5M">  
            <Event id="0"/>  
            <Event id="1" eventDestination="errorTable"/>  
            <DefaultEvents />  
          </EtwEventSourceProviderConfiguration>  
          <EtwManifestProviderConfiguration provider="5974b00b-84c2-44bc-9e58-3a2451b4e3ad" scheduledTransferLogLevelFilter="Information" scheduledTransferPeriod="PT2M">  
            <Event id="0"/>  
            <DefaultEvents eventDestination="defaultTable"/>  
          </EtwManifestProviderConfiguration>  
        </EtwProviders>  

        <WindowsEventLog scheduledTransferPeriod="PT5M">  
          <DataSource name="System!*[System[Provider[@Name='Microsoft Antimalware']]]"/>  
          <DataSource name="System!*[System[Provider[@Name='NTFS'] and (EventID=55)]]" />  
          <DataSource name="System!*[System[Provider[@Name='disk'] and (EventID=7 or EventID=52 or EventID=55)]]" />  
        </WindowsEventLog>  

        <Logs  bufferQuotaInMB="1024"   
             scheduledTransferPeriod="PT1M"   
             scheduledTransferLogLevelFilter="Verbose"   
             sinks="ApplicationInsights.AppLogs"/>  <!-- sinks attribute added in 1.5 -->  

        <CrashDumps containerName="wad-crashdumps" directoryQuotaPercentage="30" dumpType="Mini">  
          <CrashDumpConfiguration processName="mynewprocess.exe" />  
          <CrashDumpConfiguration processName="badapp.exe"/>  
        </CrashDumps>  

        <DockerSources> <!-- Added in 1.9 -->
          <Stats enabled="true" sampleRate="PT1M" scheduledTransferPeriod="PT1M" />
        </DockerSources>

      </DiagnosticMonitorConfiguration>  

      <SinksConfig>   <!-- Added in 1.5 -->  
        <Sink name="AzureMonitorSink">
            <AzureMonitor> <!-- Added in 1.11 -->
                <resourceId>{insert resourceId}</ResourceId> <!-- Parameter only needed for classic VMs and Classic Cloud Services, exclude VMSS and Resource Manager VMs-->
                <Region>{insert Azure region of resource}</Region> <!-- Parameter only needed for classic VMs and Classic Cloud Services, exclude VMSS and Resource Manager VMs -->
            </AzureMonitor>
        </Sink>
        <Sink name="ApplicationInsights">   
          <ApplicationInsights>{Insert InstrumentationKey}</ApplicationInsights>   
          <Channels>   
            <Channel logLevel="Error" name="Errors"  />   
            <Channel logLevel="Verbose" name="AppLogs"  />   
          </Channels>   
        </Sink>   
        <Sink name="EventHub"> <!-- Added in 1.7 -->
          <EventHub Url="https://myeventhub-ns.servicebus.windows.net/diageventhub" SharedAccessKeyName="SendRule" usePublisherId="false" />
        </Sink>
        <Sink name="secondaryEventHub"> <!-- Added in 1.7 -->
          <EventHub Url="https://myeventhub-ns.servicebus.windows.net/secondarydiageventhub" SharedAccessKeyName="SendRule" usePublisherId="false" />
        </Sink>
        <Sink name="secondaryStorageAccount"> <!-- Added in 1.7 -->
          <StorageAccount name="secondarydiagstorageaccount" endpoint="https://core.windows.net" />
        </Sink>
   </SinksConfig>

  </WadCfg>  

  <StorageAccount>diagstorageaccount</StorageAccount>
  <StorageType>TableAndBlob</StorageType> <!-- Added in 1.8 -->  
  </PublicConfig>  

  <PrivateConfig>  <!-- Added in 1.3 -->  
    <StorageAccount name="" key="" endpoint="" sasToken="{sas token}"  />  <!-- sasToken in Private config added in 1.8.1 -->  
    <EventHub Url="https://myeventhub-ns.servicebus.windows.net/diageventhub" SharedAccessKeyName="SendRule" SharedAccessKey="{base64 encoded key}" />

    <AzureMonitorAccount>
        <ServicePrincipalMeta> <!-- Added in 1.11; only needed for classic VMs and Classic cloud services -->
            <PrincipalId>{Insert service principal clientId}</PrincipalId>
            <Secret>{Insert service principal client secret}</Secret>
        </ServicePrincipalMeta>
    </AzureMonitorAccount>

    <SecondaryStorageAccounts>
       <StorageAccount name="secondarydiagstorageaccount" key="{base64 encoded key}" endpoint="https://core.windows.net" sasToken="{sas token}" />
    </SecondaryStorageAccounts>

    <SecondaryEventHubs>
       <EventHub Url="https://myeventhub-ns.servicebus.windows.net/secondarydiageventhub" SharedAccessKeyName="SendRule" SharedAccessKey="{base64 encoded key}" />
    </SecondaryEventHubs>

  </PrivateConfig>  
  <IsEnabled>true</IsEnabled>  
</DiagnosticsConfiguration>

Note

The public config Azure Monitor sink definition has two properties, resourceId and region. These are only required for Classic VMs and Classic Cloud services. These properties should not be used for Resource Manager Virtual Machines or Virtual Machine Scale sets. There is also an additional Private Config element for the Azure Monitor sink, that passes in a Principal Id and Secret. This is only required for Classic VMs and Classic Cloud Services. For Resource Manager VMs and VMSS the Azure Monitor definition in the private config element can be excluded.

مشاركة عبر

Windows diagnostics extension schema

Public configuration file schema

Common Attribute Types

DiagnosticsConfiguration Element

PublicConfig Element

WadCFG Element

DiagnosticMonitorConfiguration Element

CrashDumps Element

Directories Element

DataSources Element

DirectoryConfiguration Element

EtwProviders Element

EtwEventSourceProviderConfiguration Element

EtwManifestProviderConfiguration Element

Metrics Element

PerformanceCounters Element

WindowsEventLog Element

Logs Element

DockerSources

SinksConfig Element

Sink Element

Channels Element

Channel Element

PrivateConfig Element

IsEnabled Element

Example configuration

JSON

XML

الملاحظات

الموارد الإضافية