topic No log data available in Custom log sources in Log Analytics

No log data available in Custom log sources

Etienne1 — Wed, 14 May 2025 06:19:05 GMT

Hello,

I don't understand why I'm getting the ‘no log data available’ error.

I looked at this post for inspiration:
Custom Log Source - Windows Event Log

Here are some screenshots of the custom log sources and my log ingest rule and the log path I'm trying to retrieve:

%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Dhcp-Server%4Operational.evtx

kind regards

Re: No log data available in Custom log sources

AntonPineiro — Wed, 19 Feb 2025 17:10:42 GMT

Hi,

Have you check Security rules?

Your link example they had used this:

{ "directory-pattern":"/windows/system32/winevt/Logs/", "file-pattern":"*", "action":"INCLUDE" }

Best regards

Re: No log data available in Custom log sources

GerardJ — Wed, 19 Feb 2025 17:47:46 GMT

Hi @Etienne1

In the link example solution, he mentionned that he finally used this :

So adding a .evtx extension to the custom log source path.
You should try this :
Custom log Source : "Microsoft-Windows-Dhcp-Server/Operational.evtx"
Ingest Rule : easy way : "Microsoft-Windows-Dhcp-Server*" (or "Microsoft-Windows-Dhcp-Server/Operational")

Best regards

Re: No log data available in Custom log sources

Etienne1 — Thu, 20 Feb 2025 09:23:06 GMT

Hello,

I will try this solution

Re: No log data available in Custom log sources

Etienne1 — Thu, 20 Feb 2025 09:28:09 GMT

Hello,

I've already tried to use the example in the solution but it doesn't work, I'm going to try adding the security rules.

Re: No log data available in Custom log sources

Joachim_Erdei — Thu, 20 Feb 2025 10:02:03 GMT

Hi, please see https://docs.dynatrace.com/docs/analyze-explore-automate/logs/lma-log-ingestion/lma-log-ingestion-via-oa/lma-custom-log-source#mainclscuipage (point 6, Expandable Content) - there it is shown what should be provided for event logs in custom log sources

Re: No log data available in Custom log sources

Etienne1 — Thu, 20 Feb 2025 10:44:11 GMT

Hi,

I've tested your solution but it doesn't work at the moment. I think the problem is linked to permissions on the oneagent or on the server folder.