Question
You have computers that run Windows 10 and connect to an Azure Log Analytics workspace. The workspace is configured to collect all available events from the Windows event logs.
The computers have the logged events shown in the following table.
| Event ID | Log | Type | Computer |
|---|---|---|---|
| 1 | Application | Success | Computer1 |
| 2 | System | Information | Computer1 |
| 3 | Security | Audit Success | Computer2 |
| 4 | System | Error | Computer2 |
Which events are collected in the Log Analytics workspace?
- A. 1 only
- B. 2 and 3 only
- C. 1 and 3 only
- D. 1, 2, and 4 only
- E. 1, 2, 3, and 4 Correct
Explanation
With the Azure Monitor Agent, a Windows Event Logs data source in a data collection rule can collect the Application, System and Security logs at every level, and Security events are written to the Event table alongside the others. Because the workspace collects all available events from the Windows event logs, all four events, including the Security audit success event, are collected. Answer D reflects the retired Log Analytics agent, whose Windows event log data source could not collect the Security log.
