Azure Monitor | Custom Windows Logs Collection | Azure Monitor Agent 

Thank you so much.

​@@ConceptsWorkI shared your channel with everyone! Your videos helped me complete an Azure Arc project despite having no prior knowledge. Any tips on monitoring the connection status of a network-mapped drive? also, Do you offer paid training?

Thank you so much for kind acknowlegements. For network mapped device all you can do is monitoring logs with alert mechanism of log analytics workspace.

@@ConceptsWork thank you for your swift response! I would appriciate it if you could provide me more details :( I already emailed you if you have a minute to check it out :) thaaaaaank you

Hello Mike, it gives up immense pleasure when we see such deep insightful feedback on our videos. Thank you so much for giving us your time and watching our content. Let me help you understand couple of things. When you create DCR just to capture logs, which in our case windows performance and events, then the data ingestion happens to Events table in the log analytics workspace. However, when you talk about Monitoring coverage, there is a default DCR which is created and it has a different mapping altogether for data ingestion, in this scenario the data ingestion takes place in the table named as "InsightsMetrics". Similarly, when you create a DCR from sentinel console the data will be ingested to "SecurityEvents" table. The behavior of DCR and data ingestion is completely different for all the services. As the video suggests, advanced logging for windows, which means you are capturing data which is not related to performance. I hope this helps. However, there are still three videos pending, I will try to showcase this. Here are some references for data flow section for all the three scenarios. If you get some time, please watch our DCR structure video as well, which we will be releasing this weekend. Data flow for event table (DCR created directly) "dataFlows": [ { "streams": [ "Microsoft-Perf" ], "destinations": [ "la-257108454" ] }, { "streams": [ "Microsoft-Event" ], "destinations": [ "la-129300856" ] } ], Data flow for DCR created from Monitoring settings blade. "dataFlows": [ { "streams": [ "Microsoft-InsightsMetrics" ], "destinations": [ "VMInsightsPerf-Logs-Dest" ] } ] Data flow for DCR created from sentinel console. "dataFlows": [ { "streams": [ "Microsoft-SecurityEvent" ], "destinations": [ "DataCollectionEvent" ] } ], Thank you once again, for watching our content so closely, much appreciated.