Use case for managing windows event log (such as downloading files) as administrator

Question

As administrator, I want to know the use cases to manage windows event log.

According to this page, we can put those log to Log Analytics workspace but I'm new to Azure, so I don't have the knowledge to this topic..

Answer 1

Hello Shiori Hasegawa,

As per description, you want to understand the use case of windows event logs with Log Analytics Workspace.

Windows event logs are some of the most common sources for health of the client operating system and workloads of Windows machines. You can collect events from standard logs, such as System and Application, and any custom logs created by applications you need to monitor.

Azure Monitor automatically collects host metrics and activity logs from your Azure and Arc-enabled virtual machines and you need to create data collection rules (DCRs) that specify what you want to collect and where to send it.

Azure Monitor only collects events from Windows event logs that are specified in the settings. You can add an event log by entering the name of the log and selecting +. For each log, only the events with the selected severities are collected.

Refer the below document to configure windows event data

https://learn.microsoft.com/en-us/azure/azure-monitor/vm/data-collection-windows-events#configure-windows-event-data-source

Suggest you refer the below document on configuring DCRs

https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-rule-overview

Azure monitor that handles data collection and analysis with the help of DCR (Data Collection Rules - which event logs need to collect) to the destination Log Analytics workspace.

You need to install AMA (Azure Monitoring Agent) on your device and need to configure Data Collection Rules.

Please let me know if you have any further queries.