Obs/bin/GMA/Monitoring/Agent/initconfig/2.0/Standard/ServiceDependencyExtendedEvents.xml
|
<MonitoringManagement version="1.0" timestamp="2019-10-21T22:14:29.905Z">
<Events> <TextLogSubscriptions> <Subscription eventName="SvcDepDnsTransactionsRaw" format="W3c" path="%ProgramFiles%\Microsoft Dependency Agent\storage" nameFilter=".*-dns-transactions-v1\.dacsv" storeType="Local" duration="PT1M" directoryQuotaInMB="50"> <Delimiters> <Delimiter>,</Delimiter> </Delimiters> <Schema textQualifier=""" /> </Subscription> <Subscription eventName="SvcDepDnsErrorsRaw" format="W3c" path="%ProgramFiles%\Microsoft Dependency Agent\storage" nameFilter=".*-dns-errors-v1\.dacsv" storeType="Local" duration="PT1M" directoryQuotaInMB="50"> <Delimiters> <Delimiter>,</Delimiter> </Delimiters> <Schema textQualifier=""" /> </Subscription> <Subscription eventName="SvcDepHttpTransactionsRaw" format="W3c" path="%ProgramFiles%\Microsoft Dependency Agent\storage" nameFilter=".*-http-transactions-v1\.dacsv" storeType="Local" duration="PT1M" directoryQuotaInMB="50"> <Delimiters> <Delimiter>,</Delimiter> </Delimiters> <Schema textQualifier=""" /> </Subscription> </TextLogSubscriptions> <DerivedEvents> <DerivedEvent source="SvcDepDnsErrorsRaw" eventName="SvcDepDnsErrors" storeType="CentralBond" duration="PT1M"> <Query> <![CDATA[ var rawRows = select EndTime as TimeGenerated, Direction, DestinationIp, DestinationPort, Protocol, TransactionPattern, DnsQuestion, RemoteClassificationPart1 as DnsQuestionClassificationPart1, RemoteClassificationPart2 as DnsQuestionClassificationPart2, RemoteClassificationPart3 as DnsQuestionClassificationPart3, RemoteClassificationPart4 as DnsQuestionClassificationPart4, RemoteClassificationPart5 as DnsQuestionClassificationPart5, Status, Requests, MachineId, Computer, VirtualMachineNativeName as ContainerId; from rawRows let TimeGenerated = (TimeGenerated != null && TimeGenerated != "_n/a_" && TimeGenerated != "_Unknown_") ? ToUtc(TimeGenerated) : ToUtc("1981-01-01:00:00:00") let Computer = (Computer != null && Computer != "_n/a_" && Computer != "_Unknown_") ? Computer : "" let Direction = (Direction != null && Direction != "_n/a_" && Direction != "_Unknown_") ? Direction : "" let DestinationIp = (DestinationIp != null && DestinationIp != "_n/a_" && DestinationIp != "_Unknown_") ? DestinationIp : "" let DestinationPort = (DestinationPort != null && DestinationPort != "_n/a_" && DestinationPort != "_Unknown_") ? ToInt32(DestinationPort) : 0 let Protocol = (Protocol != null && Protocol != "_n/a_" && Protocol != "_Unknown_") ? Protocol : "" let TransactionPattern = (TransactionPattern != null && TransactionPattern != "_n/a_" && TransactionPattern != "_Unknown_") ? TransactionPattern : "" let DnsQuestion = (DnsQuestion != null && DnsQuestion != "_n/a_" && DnsQuestion != "_Unknown_") ? DnsQuestion : "" let Status = (Status != null && Status != "_n/a_" && Status != "_Unknown_") ? ToInt32(Status) : 0 let Requests = (Requests != null && Requests != "_n/a_" && Requests != "_Unknown_") ? ToInt32(Requests) : 0 let DnsQuestionClassificationPart1 = (DnsQuestionClassificationPart1 != null && DnsQuestionClassificationPart1 != "_n/a_" && DnsQuestionClassificationPart1 != "_Unknown_") ? DnsQuestionClassificationPart1 : "" let DnsQuestionClassificationPart2 = (DnsQuestionClassificationPart2 != null && DnsQuestionClassificationPart2 != "_n/a_" && DnsQuestionClassificationPart2 != "_Unknown_") ? DnsQuestionClassificationPart2 : "" let DnsQuestionClassificationPart3 = (DnsQuestionClassificationPart3 != null && DnsQuestionClassificationPart3 != "_n/a_" && DnsQuestionClassificationPart3 != "_Unknown_") ? DnsQuestionClassificationPart3 : "" let DnsQuestionClassificationPart4 = (DnsQuestionClassificationPart4 != null && DnsQuestionClassificationPart4 != "_n/a_" && DnsQuestionClassificationPart4 != "_Unknown_") ? DnsQuestionClassificationPart4 : "" let DnsQuestionClassificationPart5 = (DnsQuestionClassificationPart5 != null && DnsQuestionClassificationPart5 != "_n/a_" && DnsQuestionClassificationPart5 != "_Unknown_") ? DnsQuestionClassificationPart5 : "" let MachineId = (MachineId != null && MachineId != "_n/a_" && MachineId != "_Unknown_") ? MachineId : "" let ContainerId = (ContainerId != null && ContainerId != "_n/a_" && ContainerId != "_Unknown_") ? ContainerId : "" ]]> </Query> </DerivedEvent> <DerivedEvent source="SvcDepDnsTransactionsRaw" eventName="SvcDepDnsTransactions" storeType="CentralBond" duration="PT1M"> <Query> <![CDATA[ var rawRows = select EndTime as TimeGenerated, Direction, DestinationIp, DestinationPort, Protocol, TransactionPattern, RemoteClassificationPart1 as DnsServerClassificationPart1, RemoteClassificationPart2 as DnsServerClassificationPart2, RemoteClassificationPart3 as DnsServerClassificationPart3, RemoteClassificationPart4 as DnsServerClassificationPart4, RemoteClassificationPart5 as DnsServerClassificationPart5, Status, Requests, Errors, LatencyMin, LatencyMax, LatencySum, MachineId, Computer, VirtualMachineNativeName as ContainerId, ProcessId, ProcessName, ProcessUser; from rawRows let TimeGenerated = (TimeGenerated != null && TimeGenerated != "_n/a_" && TimeGenerated != "_Unknown_") ? ToUtc(TimeGenerated) : ToUtc("1981-01-01:00:00:00") let Computer = (Computer != null && Computer != "_n/a_" && Computer != "_Unknown_") ? Computer : "" let ProcessId = (ProcessId != null && ProcessId != "_n/a_" && ProcessId != "_Unknown_") ? ProcessId : "" let Direction = (Direction != null && Direction != "_n/a_" && Direction != "_Unknown_") ? Direction : "" let DestinationIp = (DestinationIp != null && DestinationIp != "_n/a_" && DestinationIp != "_Unknown_") ? DestinationIp : "" let DestinationPort = (DestinationPort != null && DestinationPort != "_n/a_" && DestinationPort != "_Unknown_") ? ToInt32(DestinationPort) : 0 let Protocol = (Protocol != null && Protocol != "_n/a_" && Protocol != "_Unknown_") ? Protocol : "" let TransactionPattern = (TransactionPattern != null && TransactionPattern != "_n/a_" && TransactionPattern != "_Unknown_") ? TransactionPattern : "" let Status = (Status != null && Status != "_n/a_" && Status != "_Unknown_") ? ToInt32(Status) : 0 let Requests = (Requests != null && Requests != "_n/a_" && Requests != "_Unknown_") ? ToInt32(Requests) : 0 let Errors = (Errors != null && Errors != "_n/a_" && Errors != "_Unknown_") ? ToInt32(Errors) : 0 let LatencyMin = (LatencyMin != null && LatencyMin != "_n/a_" && LatencyMin != "_Unknown_") ? ToInt32(LatencyMin) : 0 let LatencyMax = (LatencyMax != null && LatencyMax != "_n/a_" && LatencyMax != "_Unknown_") ? ToInt32(LatencyMax) : 0 let LatencySum = (LatencySum != null && LatencySum != "_n/a_" && LatencySum != "_Unknown_") ? ToInt64(LatencySum) : 0L let DnsServerClassificationPart1 = (DnsServerClassificationPart1 != null && DnsServerClassificationPart1 != "_n/a_" && DnsServerClassificationPart1 != "_Unknown_") ? DnsServerClassificationPart1 : "" let DnsServerClassificationPart2 = (DnsServerClassificationPart2 != null && DnsServerClassificationPart2 != "_n/a_" && DnsServerClassificationPart2 != "_Unknown_") ? DnsServerClassificationPart2 : "" let DnsServerClassificationPart3 = (DnsServerClassificationPart2 != null && DnsServerClassificationPart2 != "_n/a_" && DnsServerClassificationPart2 != "_Unknown_") ? DnsServerClassificationPart2 : "" let DnsServerClassificationPart4 = (DnsServerClassificationPart2 != null && DnsServerClassificationPart2 != "_n/a_" && DnsServerClassificationPart2 != "_Unknown_") ? DnsServerClassificationPart2 : "" let DnsServerClassificationPart5 = (DnsServerClassificationPart2 != null && DnsServerClassificationPart2 != "_n/a_" && DnsServerClassificationPart2 != "_Unknown_") ? DnsServerClassificationPart2 : "" let MachineId = (MachineId != null && MachineId != "_n/a_" && MachineId != "_Unknown_") ? MachineId : "" let ContainerId = (ContainerId != null && ContainerId != "_n/a_" && ContainerId != "_Unknown_") ? ContainerId : "" let ProcessName = (ProcessName != null && ProcessName != "_n/a_" && ProcessName != "_Unknown_") ? ProcessName : "" let ProcessUser = (ProcessUser != null && ProcessUser != "_n/a_" && ProcessUser != "_Unknown_") ? ProcessUser : "" ]]> </Query> </DerivedEvent> <DerivedEvent source="SvcDepHttpTransactionsRaw" eventName="SvcDepHttpTransactions" storeType="CentralBond" duration="PT1M"> <Query> <![CDATA[ var rawRows = select EndTime as TimeGenerated, Direction, DestinationIp, DestinationPort, Protocol, Host, HostIsLocal, HttpMethod, Path, HttpStatus, RejectReason, Requests, Errors, LatencyMin, LatencyMax, LatencySum, MachineId, Computer, VirtualMachineNativeName as ContainerId, ProcessId, ProcessName, ProcessUser; from rawRows let TimeGenerated = (TimeGenerated != null && TimeGenerated != "_n/a_" && TimeGenerated != "_Unknown_") ? ToUtc(TimeGenerated) : ToUtc("1981-01-01:00:00:00") let Computer = (Computer != null && Computer != "_n/a_" && Computer != "_Unknown_") ? Computer : "" let ProcessId = (ProcessId != null && ProcessId != "_n/a_" && ProcessId != "_Unknown_") ? ProcessId : "" let Direction = (Direction != null && Direction != "_n/a_" && Direction != "_Unknown_") ? Direction : "" let DestinationIp = (DestinationIp != null && DestinationIp != "_n/a_" && DestinationIp != "_Unknown_") ? DestinationIp : "" let DestinationPort = (DestinationPort != null && DestinationPort != "_n/a_" && DestinationPort != "_Unknown_") ? ToInt32(DestinationPort) : 0 let Protocol = (Protocol != null && Protocol != "_n/a_" && Protocol != "_Unknown_") ? Protocol : "" let Host = (Host != null && Host != "_n/a_" && Host != "_Unknown_") ? Host : "" let HostIsLocal = (HostIsLocal != null && HostIsLocal != "_n/a_" && HostIsLocal != "_Unknown_") ? HostIsLocal : "" let HttpMethod = (HttpMethod != null && HttpMethod != "_n/a_" && HttpMethod != "_Unknown_") ? HttpMethod : "" let Path = (Path != null && Path != "_n/a_" && Path != "_Unknown_") ? Path : "" let HttpStatus = (HttpStatus != null && HttpStatus != "_n/a_" && HttpStatus != "_Unknown_") ? HttpStatus : "" let RejectReason = (RejectReason != null && RejectReason != "_n/a_" && RejectReason != "_Unknown_") ? RejectReason : "" let Requests = (Requests != null && Requests != "_n/a_" && Requests != "_Unknown_") ? ToInt32(Requests) : 0 let Errors = (Errors != null && Errors != "_n/a_" && Errors != "_Unknown_") ? ToInt32(Errors) : 0 let LatencyMin = (LatencyMin != null && LatencyMin != "_n/a_" && LatencyMin != "_Unknown_") ? ToInt32(LatencyMin) : 0 let LatencyMax = (LatencyMax != null && LatencyMax != "_n/a_" && LatencyMax != "_Unknown_") ? ToInt32(LatencyMax) : 0 let LatencySum = (LatencySum != null && LatencySum != "_n/a_" && LatencySum != "_Unknown_") ? ToInt64(LatencySum) : 0L let MachineId = (MachineId != null && MachineId != "_n/a_" && MachineId != "_Unknown_") ? MachineId : "" let ContainerId = (ContainerId != null && ContainerId != "_n/a_" && ContainerId != "_Unknown_") ? ContainerId : "" let ProcessName = (ProcessName != null && ProcessName != "_n/a_" && ProcessName != "_Unknown_") ? ProcessName : "" let ProcessUser = (ProcessUser != null && ProcessUser != "_n/a_" && ProcessUser != "_Unknown_") ? ProcessUser : "" ]]> </Query> </DerivedEvent> </DerivedEvents> </Events> </MonitoringManagement> |