Server core event logs

Occasional Contributor

I have been using the Log Analytics agent to get on-premise server event logs into Sentinel and all has gone well with the exception for Server core boxes. Server Core isn't listed as supported ( so was wondering what is the best way to get server core logs over into Sentinel.

3 Replies
best response confirmed by fishermc (Occasional Contributor)
You will need WEF/WEC but support for that will be added in a future release of the Azure Monitor Agent.
Just curious if happen to know when that future release might be? Something like or 1 or 2 months or as long as a year?

Thanks for the response to the initial question.
Sorry its an NDA item, are you a member of the Private Preview (if your company has an NDA with Microsoft, you can signup in the Azure Sentinel Portal - News & Guides - What's New - Private Preview link: