Azure Monitor Agent-DCR custom path template for filtering Database logs

Question

Hi There!

I would like to filter out Database logs using Azure Monitor Agent DCR by custom x-path queries.

1. Is there any readymade x-path queries available to filter the audit logs of Oracle DB, MSSQL DB and MYSQL DB?

Thanks in Advance!

Answer 1

Azure Monitor Agent XPath queries are only for Windows Event Logs in a DCR. In the DCR schema, xPathQueries belongs to the windowsEventLogs data source, and Microsoft’s AMA documentation shows XPath filtering only for Windows event channels such as Application, System, and Security.

So for your question, there aren’t Microsoft-provided ready-made XPath queries for Oracle DB, MySQL DB, or generic database audit logs. For those sources, the usual approach is:

If the database writes to text files, collect them with Custom Text Logs via AMA using file patterns in the DCR.

If the database writes to syslog, collect them with Syslog via AMA and filter by facility/severity.

If you need content-based filtering, use DCR ingestion-time transformations with KQL to filter or reshape the records before they’re stored.

For MSSQL, there is one exception: if SQL Server Audit is configured to write to the Windows Application log or Windows Security log, then you can use AMA Windows Event collection and create your own XPath filter for those events. Microsoft documents that SQL Server Audit targets can be a file, the Windows Security event log, or the Windows Application event log.