-
-
Notifications
You must be signed in to change notification settings - Fork 38
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Missing Output to Log Analytics Workspace in latest Version #61
Comments
Hiya, No worries, thanks for using it :) I can add the interface, I just wasn't sure which ones were actually being used. I'll have time to work on it monday or tuesday, so you can expect it in the coming days. I'll update here when it's available! |
A new version is available that supports the Azure Log Analytics interface. Due to the full rewrite some small changes might be required:
New syntax would look like:
Let me know how it works for you. It's a full rewrite but I tested it as much as I could by myself. Release: |
@ddbnl I have tested your recent version against my LogAnalytics-Workspace and must confirm, that no Tables inside Log Analytics workspace appear. However, I have noticed the following points:
Console Output
The Custom Log Table are still missing: |
I'll take a look asap. I can at least confirm the logging issue, I'll fix that and link the new release here when it's done. In regards to log analytics, do you also have the output defined in the config, and the log analytics key as a command line arg? The config (based on your post) would be:
And the command would be:
You can get the log analytics key as follows using AZ CLI:
If you already had all that then I will try to reproduce. Thanks for testing! |
@ddbnl i can confirm that I have configured the Collector as described above. For me it looks like that the Logs are fetched correctly. But when shifting them to the log analytics workspace, it will fail. |
So far I have not been able to reproduce, for me the tables show up. My test is creating a log analytics workspace (just next, next, finish) and putting the workspace ID in the config. Then getting the shared key:
And putting the result in the '--oms-key' parameter. This gives the following result: The result config is (also to enable logging):
I have released a new version with fixed logging and also extended logging, hopefully we'll be able to capture the error: https://github.com/ddbnl/office365-audit-log-collector/releases/tag/v2.3.1 Let me know what it does for you. |
I just fixed a bug that caused issues with the 'hoursToCollect' parameter. If you were using it, you might want to try with the latest release. https://github.com/ddbnl/office365-audit-log-collector/releases/tag/v2.3.2 It also added an interactive interface that can be used for testing. If you have the new release, you can run the command as you did before, but add the '--interactive' command line parameter. This allows you to run the collector and immediately see the logs for any errors. |
Thanks a lot for your effort to keep this tool running!
I am collecting the O365 Logs for over 10,000 Users and put them into a Log Analytics workspace. I would really appreachiate to have this feature in your latest Rust-Version.
The text was updated successfully, but these errors were encountered: