Specific Windows Event Logs (Non Standard)

(Paul) #1

Hi Guys

We are successfully collecting logs from Standard Windows Event Logs such as Application, and System. On A windows Host, you find these logs listed under “Windows Logs”, in the event Viewer.

In Event Viewer, you can expand Applications and Services Logs, then Expand Microsoft, Expand Windows, and you find a hole raft of Specific logs …

If I wanted to Log messages from TerminalServices-LocalSessionManager > Operational Log … Is that possible?

What I’ve tried and hasn’t worked is. On the windows machine, I can see the event log lives under %SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx. The same location as the System and Application Logs. So I defined a Beats Input to collect events from a log called Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational, but that isn’t collecting the messages …

Any idea ?


(Jan Doberstein) #2

Did you look at this blog post?

This might help you

(Paul) #3

Thank you! :slight_smile: I will give it a go.

Looks like I need something along the lines of : [{‘name’:‘Microsoft-Windows-Sysmon/Operational’}]