I am planning to pull DC and DNS logs from the same server. I was successfully able to pull the DC logs with the agent windows logs. but for DNS I configured the flatfile and tried to pull with the agent file logs and I am seeing no logs pulled into our server.
I will be needing DNS debug log file. I tried to add the DNS channel to the agent windows logs itself and As per the investigation I have done, I could see the DNS channel we added is pulling only logs with 5502 event id.
Kindly let me know if we can enable the debug logs in the event channel itself.
Event channel as of now holds Analytical and Audit logs . I tried enabling the same yesterday. As of now I can see with the audit logs enabled there are no details of DNS data which is relevant for monitoring.
The analytical logs were introduced in server 2012 and 2016 . Can this be considered as an alternative for debug logs to see the DNS transactions.
Kindly let us know if I can use the same below mentioned method to enable the same in the DNS channel so that we will be able to pull the same.
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn800669(v=ws.11)#:~:text=To%20enable%20DNS%20diagnostic%20logging,-Type%20eventvwr.&text=In%20Event%20Viewer%2C%20navigate%20to,Analytical%20log%20will....
To enable the debug logs we will be configuring the log path in the DNS manager and this will create a flat file for the debug logs. This is then pulled using the endpoint agent. Which is not working in our scenario.
(https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc776445(v=ws.10)?redirectedfrom=MSDN)
