Trace Event Logs

[Dan_Cook1 (Dan Cook)]

The vast majority of useful logging on Windows is now in the ETW style trace logs. These are visible in Event Viewer under the "Applications and Service Logs". Can Heartbeat gather and ship these logs?

I ask because the documentation says to use Powershell command "get-eventlog *" to view a list of event logs. This command will only list old style event logs and not the newer ETW trace style, to list the newer style logs - you should use "get-winevent -listlog *"

[andrewkroh]

Have you see this: https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html#configuration-winlogbeat-options-event_logs-name

Winlogbeat can read the logs listed by Get-WinEvent -ListLog *.

Only Analytic and Debug logs are based on ETW and Winlogbeat cannot read those. Analytic and Debug logs are disabled and hidden by default in event viewer.

There has been a request to add a feature in Beats for ETW. https://github.com/elastic/beats/issues/2073

[Dan_Cook1 (Dan Cook)]

Thankyou @andrewkroh - No i hadn't seen that and feel slightly embarrassed as its in the offical docs!