Want to Monitor the DNS server from Azure Monitor

Question

Hi Experts,

I want to monitor the Logs from the DNS server which is hosted in Azure VM (Windows Server) and set alerts so that if any there is any error or critical log came it should alert out Support team, but while configuring all the log analytics workspace, DSR and endpoint i am not getting the error logs in the azure monitor

Also i have turn off the DNS server from the services.msc but also also not getting any critical or error log for this, also under event log we are not getting any logs for DNS server under Applications and services logs

1. From where we can get the logs related to the DNS server in event log
2. How can we get the logs in azure monitor

Thanks

Answer 1

@abhi Welcome to Microsoft Q & A Community Forum. Here is a document where it's mentioned on how to collect logs from DNS Server using AMA.

Also, as per this document the logs are visible in following categories:

1. Application
2. System
3. DNS Server

Kindly check it out to see if it's helpful. Revert if you have further questions.

Answer 2

Hi Abhi,

To add another tip regarding your questions:

In order to collect DNS logs from your Azure VM windows server to Azure Monitor, you'd need to enable logging from the VM to your monitor workspace with the Azure Monitor Agent.
This will also create a Data Collection rule.

After about a minute you can go to the "Data Collection Rules" blade and you'll see your new DCR.
Now select 'add rule' and configure the collection of your windows events.
Depending on where your dns logs are stored you may be able to use the default filters or you can create a custom one.

If you need to create an xpath, the UI can give you some tips by checking off some of the default options and then selecting the custom tab: it shows you the xpath for what you selected: