topic Re: Windows logfiles in Log Analytics

Windows logfiles

henk_stobbe — Wed, 18 Mar 2020 17:29:12 GMT

Hello,

Is it true that the windows security, system and application logfile can not be excluded by the OneAgent configuration?

KR Henk

Re: Windows logfiles

dave_mauney — Wed, 18 Mar 2020 17:45:42 GMT

You want to have access to process logs and not host logs, which means turning off logging at the host level is not acceptable? Because I think there is no option to just turn off host level logs. Maybe someone else knows of a hidden flag.

Re: Windows logfiles

henk_stobbe — Wed, 18 Mar 2020 17:51:04 GMT

Hi Dave,

Thanks for the reply, the use case was based on a request to turn off the access to the security log, But answer will be the same (-;

KR Henk

Re: Windows logfiles

dave_mauney — Wed, 18 Mar 2020 18:00:06 GMT

Good news. It appears they added some new support that will let you do this:

https://www.dynatrace.com/support/help/shortlink/windows-custom-installation#access-to-system-logs

--set-system-logs-access-enabled=false disables access to logs --set-system-logs-access-enabled=true enables access to logs

Hope this helps!

dave

Re: Windows logfiles

dave_mauney — Wed, 18 Mar 2020 18:01:51 GMT

I do find this statement confusing however: "OneAgent doesn't currently download any Windows system logs, but this can change in future releases." Based on this statement, I would say test it out and see if it works for you or not!

Re: Windows logfiles

dave_mauney — Wed, 18 Mar 2020 18:03:33 GMT

Arg. I should have read more carefully before posting:

"Note that this is a self-diagnostics setting"

Re: Windows logfiles

marcin_okraszew — Thu, 19 Mar 2020 07:15:55 GMT

The mentioned setting affects only if system logs are included in the support archive created for an agent. It doesn't affect log monitoring functionality. In log monitoring you can disable the mentioned logs from uploaded in UI in the log sources configuration, but to my knowledge, it is not possible for on-demand access.

Re: Windows logfiles

marcin_okraszew — Thu, 19 Mar 2020 10:08:03 GMT

An update - there is a troubleshooting possibility to turn off the security log, but unfortunately you need to contact support to do that.

Re: Windows logfiles

techean — Thu, 02 Feb 2023 08:00:40 GMT

Hi, is there a way to get this done for security logs!