Forum Discussion

Brass Contributor

Jan 02, 2020

How can I track Windows Update installation dates with Common Events and without Update Management?

We currently have servers forwarding logs to Azure via Security Center and the Microsoft Monitoring Agent. To reduce costs our log level is set to Common Events and we're using the North Europe regio...

Azure Log Analytics

azure monitor

Noa Kuperberg

Microsoft

Jan 06, 2020

endakelly

Seems to me that Event ID 20 is what you're looking for...

Can you use these queries?

Event | where Source=="Microsoft-Windows-WindowsUpdateClient"

Event | where EventID == 20

endakelly

Brass Contributor

Jan 13, 2020

Noa Kuperberg thanks for the reply.

Unfortunately. that event does not appear if Security Center is set to the Common data tier. Is there a way to add just a specific event ID to this tier without switching to the All event data tier? I am hesitant to log all events due to the volume.

Thanks,

Enda