How to collect windows event logs in Logging Analytics

If you want to collect the windows events and logs from OCI(Oracle Cloud Infrastructure) instances you need to install the management agents as the management plugin is not yet available for windows platform image as you see in the below image .

1. Search for Downloads and Keys in the search bar at the top and navigate to this page.

Download the latest agent file based on the architecture for windows OS and move the files to the windows system where you need to install. I can do this by uploading to a private object storage bucket and create a PAR(Pre-Authenticated Request) to access/download it later from other systems.

2. Create a key and download key to file by clicking on the three dots next to the newly created key.

While creating key it’s best to avoid checking the unlimited options for security reasons.

Uncomment the Service.plugin.logan.download=true to use logging analytics plugin.Similarly if you want to install other plugins you can uncomment those lines as well.You can specify a AgentDisplayName if needed .

########################################################################
# Please refer the following Management Agent Installation Guide for more details.
#
# https://docs.cloud.oracle.com/iaas/management-agents/index.html
#
# Since this file has sensitive information, please make sure that after
# executing setup.sh you either delete this file or store it in a secure
# location.
#
########################################################################
ManagementAgentInstallKey = <keyvalue>
AgentDisplayName = 
#Please uncomment the below tags properties and provide values as needed
#FreeFormTags = [{"<key1>":"<value1>"}, {"<key2>":"<value2>"}]
#DefinedTags = [{"namespace1":{"<key1>":"<value1>"}}, {"namespace2":{"<key2>":"<value2>"}}]
CredentialWalletPassword = 
#Service.plugin.opsiHost.download=true
#Service.plugin.dbaas.download=true
#Service.plugin.jm.download=true
Service.plugin.logan.download=true
#Service.plugin.osmh.download=true
#Service.plugin.jms.download=true
#Service.plugin.appmgmt.download=true

Incase if you forgot to uncomment during installation don’t worry you can enable the plugin later by navigating to Agents and Deploy plugin.

Installing and Managing Oracle Management Agents

Management Agent requires JDK8 only. Ensure you have downloaded and installed the latest version of JDK8 or JRE8 (version 1.8u281 or higher) before starting the Management Agent software installation process.

Open command prompt as administrator as its needed for agent installation.

java -version (To check java version is greater than 1.8u281)

java version

mklink /J C:\jre-latest “C:\Program Files\Java\jre-1.8”(To create symbolic link as mentioned in the doc under Using java with management Agent )

set JAVA_HOME=C:\jre-latest

You can run curl command to download it if you have kept it in the object storage and created the PAR.

curl <PAR url> -o agent.zip (To download from the PAR url)

tar -xf agent.zip(To unzip the file)

installer.bat C:/Agents/agent.rsp (Command to install the agent in windows)

C:\Agents>installer.bat C:\Agents\agent.rsp
         64 bit Windows OS found.
Checking pre-requisites

        Checking if previous agent service exists
        Checking if C:\Oracle\mgmt_agent\agent_inst directory exists
        Checking Java version
                Java version: 1.8.0_381 found at C:\jre-latest
        Checking if C:\Oracle\mgmt_agent\230821.1905 directory exists

Executing install
        Unpacking software zip
        Copying files to destination dir (C:\Oracle\mgmt_agent)
        Initializing software from template
        Checking if JavaScript engine is available to use
        Creating mgmt_agent service

Agent install successful

Executing configure

        Parsing input response file
        Validating install key
        Generating communication wallet
        Generating security artifacts
        Registering Management Agent
                Found service plugin(s): [logan]

The Oracle Management Agent service is starting....
The Oracle Management Agent service was started successfully.

Starting plugin deployment for: [logan]
Deploying service plugin(s)......Done.
        logan : Successfully deployed service plugin

Agent setup completed and the agent is running

If for some reason the installation failed ,you can uninstall and re-install it.

C:\Oracle\mgmt_agent\uninstaller.bat (To uninstall the agent in windows)

sc query mgmt_agent(To check the windows service status)

sc stop mgmt_agent (To stop the service)

sc start mgmt_agent (To start the service)

Once the agent is successfully installed navigate to Logging analytics →Administration → Sources

Search for windows in the search bar

By default the Auto Association is disabled . If you enable it the log source will get automatically associated with all Host (windows) entity.

If you want to enable logs for selected windows host then you can use the Add Data workflow under Logging Analytics Administration page.

Choose Windows Events

Add Data workflow

Select the specific entities you want to enable the logs in this page.

Select the log sources you want to enable for the selected windows host.

In few minutes you should see the data flow in the Log Explorer.Select Last 24 hours or 7 days to see old data.

Windows Event Logs