Hello Justin Sylvestre,
Welcome to the Microsoft Q&A and thank you for posting your questions here.
Problem
I understand that you are having challenges to collect W3C logs from a C# site (deployed with nlog) and you would need to ensure your custom table can ingest data.
Solution
You have done a lot. Well done. To troubleshoot and successfully collect W3C logs from your C# site and ensure your custom table in the log analytics workspace ingests data, review this these steps carefully:
- Though, you mentioned DCR is well connected and configure. Kindly review this sample code snippet (JSON for DCR) to ensure your DCR is configured to collect custom logs from the specified path.
{
"kind": "Linux",
"properties": {
"dataSources": {
"customLogs": [
{
"name": "W3CLogs",
"directory": "C:\\logs\\",
"filter": "w3c_logfile.log",
"format": "W3C"
}
]
},
"destinations": {
"logAnalytics": {
"workspaceId": "<your_workspace_id>"
}
}
}
}
Make sure the log path (C:\logs\w3c_logfile.log
) matches the path you configured in your Data Collection Rule (DCR).
- Since DCR was downloaded and applied by the agent. Use the following Kusto Query Language (KQL) query to check if data is being ingested into your custom table in Log Analytics:
CustomTable_CL
| where TimeGenerated > ago(1h)
| sort by TimeGenerated desc
Replace CustomTable_CL
with the name of your custom table.
https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/
- Ensure the Azure Monitor Agent has read permissions for the log directory and files. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview
- Review Azure Monitor Agent logs for any errors related to log collection or DCR application. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-troubleshoot
- Double-check the DCR configuration for any syntax errors or incorrect paths. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent
Kindly utilize the links above for more detailed steps and information.
Accept Answer
I hope this is helpful! Do not hesitate to let me know if you have any other questions.
** Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful ** so that others in the community facing similar issues can easily find the solution.
Best Regards,
Sina Salam