2

We're running Application Insights on some of our sites and we want to aggregate logs from the windows event log. We are running on windows server 2016.

I know that other log-shippers like elastic has the possibility to send logs from the windows event log. Is it possible from Application Insights?

Edit 22.10.2018

After @cijothomas's comment I tried adding the EtwCollector nuget package from Microsoft and added a few providers to the config. 

<Add ProviderName="Microsoft-Windows-Crashdump" Level="Warning"/>
<Add ProviderName=".NET Common Language Runtime" Level="Warning" />
<Add ProviderName="ASP.NET Events" Level="Warning" />
<Add ProviderName="Microsoft-Windows-IIS-IISReset" Level="Warning" />
<Add ProviderName="Microsoft-Windows-HttpLog" Level="Warning" />

In Application Insights, I now get a trace from the application.

AI: Failed to enable provider for the EtwTelemetryModule. Access Denied.

and for example for the Microsoft-Windows-IIS-IISReset provider.

AI: Failed to enable provider Microsoft-Windows-IIS-IISReset for the EtwTelemetryModule.

I've added the applications user process to the "Performance Log Users" group in windows. Is it any other setting that I need to add to allow the logs to be shipped from this provider?

CosX
  • 1,920
  • 2
  • 15
  • 25

1 Answers1

3

Did you mean ETW events? if yes, then Application Insights has an adapter to send ETW events as Application Insights Traces. https://learn.microsoft.com/en-us/azure/application-insights/app-insights-asp-net-trace-logs#using-etw-events

Alternately, you can always do manual TrackTrace() method to send any traces to Application Insights. https://learn.microsoft.com/en-us/azure/application-insights/app-insights-api-custom-events-metrics#tracktrace

cijothomas
  • 2,818
  • 1
  • 13
  • 25
  • 1
    Another solution to send windows event logs would be to use Log Analytics from Azure. https://learn.microsoft.com/en-us/azure/log-analytics/log-analytics-quick-collect-windows-computer#collect-event-and-performance-data – cijothomas Apr 12 '18 at 19:16