From ceb1672a5fff6749de07224fc70a8b32038b3b6f Mon Sep 17 00:00:00 2001 From: "Scott Roberts (Azure)" Date: Tue, 28 Jan 2025 13:32:07 -0800 Subject: [PATCH 1/4] Adding additional logs for Windows Manifests --- docs/manifest_by_file.md | 94 +++++++++++++++++++------------- docs/manifest_content.md | 92 +++++++++++++++++++++++++++---- manifests/windows/diagnostic | 35 +++++++++--- manifests/windows/min-diagnostic | 9 +++ manifests/windows/vmdiagnostic | 60 ++++++++++++++++++-- 5 files changed, 230 insertions(+), 60 deletions(-) diff --git a/docs/manifest_by_file.md b/docs/manifest_by_file.md index d3dedef..f489edf 100644 --- a/docs/manifest_by_file.md +++ b/docs/manifest_by_file.md @@ -379,12 +379,12 @@ File Path | Manifest /Packages/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/Service/ServiceF
abricNodeBootstrapAgent.InstallLog | agents, diagnostic, normal, vmdiagnostic, windowsupdate /Packages/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/Service/ServiceF
abricNodeBootstrapAgent.InstallState | agents, diagnostic, normal, vmdiagnostic, windowsupdate /Packages/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/Service/current.
config | agents, diagnostic, normal, vmdiagnostic, windowsupdate -/Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/RuntimeSett
ings/VMApp.lockfile | agents, diagnostic -/Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/RuntimeSett
ings/applicationRegistry.active | agents, diagnostic -/Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/RuntimeSett
ings/applicationRegistry.backup | agents, diagnostic -/Packages/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/RuntimeSettings
/VMApp.lockfile | agents, diagnostic, normal -/Packages/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/RuntimeSettings
/applicationRegistry.active | agents, diagnostic, normal -/Packages/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/RuntimeSettings
/applicationRegistry.backup | agents, diagnostic, normal +/Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/RuntimeSett
ings/VMApp.lockfile | agents, diagnostic, vmdiagnostic +/Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/RuntimeSett
ings/applicationRegistry.active | agents, diagnostic, vmdiagnostic +/Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/RuntimeSett
ings/applicationRegistry.backup | agents, diagnostic, vmdiagnostic +/Packages/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/RuntimeSettings
/VMApp.lockfile | agents, diagnostic, normal, vmdiagnostic +/Packages/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/RuntimeSettings
/applicationRegistry.active | agents, diagnostic, normal, vmdiagnostic +/Packages/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/RuntimeSettings
/applicationRegistry.backup | agents, diagnostic, normal, vmdiagnostic /Packages/Plugins/Microsoft.Compute.BGInfo/\*/BGInfo.def.xml | agents, diagnostic, normal, vmdiagnostic, windowsupdate /Packages/Plugins/Microsoft.Compute.BGInfo/\*/PluginManifest.xml | agents, diagnostic, normal, vmdiagnostic, windowsupdate /Packages/Plugins/Microsoft.Compute.BGInfo/\*/config.bgi | agents, diagnostic, normal, vmdiagnostic, windowsupdate @@ -475,8 +475,8 @@ File Path | Manifest /Windows/Inf/netcfg\*.\*etl | normal /Windows/Inf/setupapi.dev.log | normal /Windows/Logs/CBS/\*.cab | windowsupdate -/Windows/Logs/CBS/\*.log | windowsupdate -/Windows/Logs/DISM/\*.log | windowsupdate +/Windows/Logs/CBS/\*.log | min-diagnostic, windowsupdate +/Windows/Logs/DISM/\*.log | min-diagnostic, windowsupdate /Windows/Logs/MoSetup/UpdateAgent.log | windowsupdate /Windows/Logs/NetSetup/\*.etl | windowsupdate /Windows/Logs/OpsMgrTrace/\*.\* | monitor-mgmt @@ -486,7 +486,7 @@ File Path | Manifest /Windows/Logs/SystemRestore/\*.\* | windowsupdate /Windows/Logs/WindowsUpdate/WindowsUpdate.\*.etl | monitor-mgmt, windowsupdate /Windows/Logs/dpx/\*.log | windowsupdate -/Windows/Logs/eBPF/committed/\* | agents, diagnostic, normal +/Windows/Logs/eBPF/committed/\* | agents, diagnostic, min-diagnostic, normal, vmdiagnostic /Windows/Logs/mosetup/bluebox.log | windowsupdate /Windows/Logs/waasmedic/waasmedic.\*.etl | windowsupdate /Windows/Microsoft.NET/Framework/v4.0.30319/Config/machine.config | diagnostic, min-diagnostic, vmdiagnostic, windowsupdate @@ -532,7 +532,11 @@ File Path | Manifest /Windows/System32/config/SYSTEM | diagnostic, min-diagnostic, vmdiagnostic, windowsupdate /Windows/System32/config/SYSTEM.LOG1 | min-diagnostic /Windows/System32/config/SYSTEM.LOG2 | min-diagnostic +/Windows/System32/winevt/Logs/Active Directory Web Services.evtx | diagnostic, vmdiagnostic /Windows/System32/winevt/Logs/Application.evtx | agents, aks, diagnostic, eg, min-diagnostic, normal, servicefabric, site-recovery, sql-iaas, vmdiagnostic, windowsupdate, workloadbackup +/Windows/System32/winevt/Logs/DFS Replication.evtx | diagnostic, vmdiagnostic +/Windows/System32/winevt/Logs/DNS Server.evtx | diagnostic, vmdiagnostic +/Windows/System32/winevt/Logs/Directory Service.evtx | diagnostic, vmdiagnostic /Windows/System32/winevt/Logs/Microsoft-AKSGMSAPlugin%4Admin.evtx | aks /Windows/System32/winevt/Logs/Microsoft-Automation%4Operational.evtx | monitor-mgmt /Windows/System32/winevt/Logs/Microsoft-SMA%4Debug.etl | monitor-mgmt @@ -544,12 +548,20 @@ File Path | Manifest /Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker%4BitLocker Management.evtx | diagnostic, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker-DrivePreparationTool%4Opera
tional.evtx | diagnostic, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-Bits-Client%%4Operational.evtx | windowsupdate -/Windows/System32/winevt/Logs/Microsoft-Windows-CAPI2%4Operational.evtx | agents, diagnostic, eg, vmdiagnostic, windowsupdate +/Windows/System32/winevt/Logs/Microsoft-Windows-CAPI2%4Operational.evtx | agents, diagnostic, diagnostic, eg, vmdiagnostic, vmdiagnostic, windowsupdate +/Windows/System32/winevt/Logs/Microsoft-Windows-CodeIntegrity%4Operational.evtx | diagnostic, vmdiagnostic /Windows/System32/winevt/Logs/Microsoft-Windows-Containers-CCG%4Admin.evtx | aks +/Windows/System32/winevt/Logs/Microsoft-Windows-DNS-Client%4Operational.evtx | diagnostic, vmdiagnostic +/Windows/System32/winevt/Logs/Microsoft-Windows-DNSServer%4Audit.evtx | diagnostic, vmdiagnostic /Windows/System32/winevt/Logs/Microsoft-Windows-DSC%4Operational.evtx | agents, diagnostic, eg, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-DeliveryOptimization%%4Operational.ev
tx | windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-Dhcp-Client%4Admin.evtx | eg /Windows/System32/winevt/Logs/Microsoft-Windows-Dhcp-Client%4Operational.evtx | eg, windowsupdate +/Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-Apps%4Admin.evtx | diagnostic, vmdiagnostic +/Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-Apps%4Operational.evtx | diagnostic, vmdiagnostic +/Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-CloudCache%4Admin.evtx | diagnostic, vmdiagnostic +/Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-CloudCache%4Operational.evtx | diagnostic, vmdiagnostic +/Windows/System32/winevt/Logs/Microsoft-Windows-GroupPolicy%4Operational.evtx | diagnostic, vmdiagnostic /Windows/System32/winevt/Logs/Microsoft-Windows-Host-Network-Service-Admin.evtx | aks /Windows/System32/winevt/Logs/Microsoft-Windows-Host-Network-Service-Operational.evtx | aks /Windows/System32/winevt/Logs/Microsoft-Windows-Hyper-V-Compute-Admin.evtx | aks @@ -557,6 +569,7 @@ File Path | Manifest /Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-PnP%%4Configuration.evtx | windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-PnP%4Configuration.evtx | agents, diagnostic, eg, min-diagnostic, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-PnPConfig%4Configuration.evtx | agents, diagnostic, eg, vmdiagnostic, windowsupdate +/Windows/System32/winevt/Logs/Microsoft-Windows-NTLM%4Operational.evtx | diagnostic, vmdiagnostic /Windows/System32/winevt/Logs/Microsoft-Windows-NdisImPlatform%4Operational.evtx | agents, diagnostic, eg, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-NetworkLocationWizard%4Operational.ev
tx | agents, diagnostic, eg, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-NetworkProfile%4Operational.evtx | agents, diagnostic, eg, min-diagnostic, vmdiagnostic, windowsupdate @@ -572,6 +585,8 @@ File Path | Manifest /Windows/System32/winevt/Logs/Microsoft-Windows-SMBServer%4Operational.evtx | diagnostic, eg, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-ServerManager%4Operational.evtx | diagnostic, eg, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-SmbClient%4Connectivity.evtx | diagnostic, eg, vmdiagnostic, windowsupdate +/Windows/System32/winevt/Logs/Microsoft-Windows-SmbClient%4Security.evtx | diagnostic, vmdiagnostic +/Windows/System32/winevt/Logs/Microsoft-Windows-SmbServer%4Security.evtx | diagnostic, vmdiagnostic /Windows/System32/winevt/Logs/Microsoft-Windows-Store%%4Operational.evtx | windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-TCPIP%4Operational.evtx | agents, diagnostic, eg, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-TaskScheduler%%4Operational.evtx | windowsupdate @@ -584,6 +599,7 @@ File Path | Manifest /Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServices-RemoteConnectionMana
ger%4Operational.evtx | diagnostic, eg, min-diagnostic, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServices-SessionBroker-Client
%4Admin.evtx | diagnostic, eg, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServices-SessionBroker-Client
%4Operational.evtx | diagnostic, eg, vmdiagnostic, windowsupdate +/Windows/System32/winevt/Logs/Microsoft-Windows-User Profile Service%4Operational.evt
x | diagnostic, vmdiagnostic /Windows/System32/winevt/Logs/Microsoft-Windows-UserPnp%4DeviceInstall.evtx | agents, diagnostic, eg, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-Windows Firewall With Advanced Securi
ty%4ConnectionSecurity.evtx | agents, diagnostic, eg, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/Microsoft-Windows-Windows Firewall With Advanced Securi
ty%4Firewall.evtx | agents, diagnostic, eg, min-diagnostic, vmdiagnostic, windowsupdate @@ -596,6 +612,8 @@ File Path | Manifest /Windows/System32/winevt/Logs/Microsoft-WindowsAzure-Status%4GuestAgent.evtx | agents, diagnostic, eg, monitor-mgmt, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/Microsoft-WindowsAzure-Status%4Plugins.evtx | agents, diagnostic, eg, monitor-mgmt, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/MicrosoftAzureRecoveryServices-Replication.evtx | diagnostic, eg, vmdiagnostic, windowsupdate +/Windows/System32/winevt/Logs/OpenSSH%4Admin.evtx | diagnostic, vmdiagnostic +/Windows/System32/winevt/Logs/OpenSSH%4Operational.evtx | diagnostic, vmdiagnostic /Windows/System32/winevt/Logs/Security.evtx | diagnostic, eg, min-diagnostic, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/Setup.evtx | diagnostic, eg, min-diagnostic, vmdiagnostic, windowsupdate /Windows/System32/winevt/Logs/System.evtx | agents, aks, diagnostic, eg, min-diagnostic, normal, servicefabric, site-recovery, sql-iaas, vmdiagnostic, windowsupdate, workloadbackup @@ -616,7 +634,7 @@ File Path | Manifest /Windows/debug/netlogon.log | diagnostic, eg, normal, vmdiagnostic, windowsupdate /Windows/servicing/sessions/sessions.xml | diagnostic, min-diagnostic, vmdiagnostic, windowsupdate /Windows/system32/winevt/Logs/Operations Manager.evtx | monitor-mgmt -/Windows/windowsupdate\*.log | windowsupdate +/Windows/windowsupdate\*.log | min-diagnostic, windowsupdate /WindowsAzure/Config/\* | monitor-mgmt /WindowsAzure/GuestAgent\*/CommonAgentConfig.config | diagnostic, vmdiagnostic, windowsupdate /WindowsAzure/Logs/AggregateStatus/\*.json | monitor-mgmt @@ -640,49 +658,49 @@ File Path | Manifest /WindowsAzure/Logs/Plugins/Microsoft.Azure.Security.AzureDiskEncryption/\*/BitlockerE
xtension.log | diagnostic, vmdiagnostic /WindowsAzure/Logs/Plugins/Microsoft.Azure.Security.IaaSAntimalware/\*/AntimalwareCon
fig.log | agents, diagnostic, normal, vmdiagnostic, windowsupdate /WindowsAzure/Logs/Plugins/Microsoft.Azure.Security.Monitoring/\*/AsmExtension.log | agents, diagnostic, normal, vmdiagnostic, windowsupdate -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.ServiceFabricMCNode/Event
s/sfmcnodeagent_Temp/Raw/sfmcnodeagent\*.log | diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.ServiceFabricMCNode/\*/\*
.log | diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.SfmcSetup/Events/sfmcsetu
pextagent_Temp/Raw/sfmcsetupextagent\*.log | diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.SfmcSetup/\*/\*.log | diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.ServiceFabricMCNode-
Test/Events/sfmcnodeagent_Temp/Raw/sfmcnodeagent\*.log | diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.ServiceFabricMCNode-
Test/\*/\*.log | diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.SfmcSetup-Test/Event
s/sfmcsetupextagent_Temp/Raw/sfmcsetupextagent\*.log | diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.SfmcSetup-Test/\*/\*
.log | diagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.ServiceFabricMCNode/Event
s/sfmcnodeagent_Temp/Raw/sfmcnodeagent\*.log | diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.ServiceFabricMCNode/\*/\*
.log | diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.SfmcSetup/Events/sfmcsetu
pextagent_Temp/Raw/sfmcsetupextagent\*.log | diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.SfmcSetup/\*/\*.log | diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.ServiceFabricMCNode-
Test/Events/sfmcnodeagent_Temp/Raw/sfmcnodeagent\*.log | diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.ServiceFabricMCNode-
Test/\*/\*.log | diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.SfmcSetup-Test/Event
s/sfmcsetupextagent_Temp/Raw/sfmcsetupextagent\*.log | diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.SfmcSetup-Test/\*/\*
.log | diagnostic, vmdiagnostic /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.\*ServiceFabricMCNode\*/E
vents/\* | servicefabric /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.\*ServiceFabricMCNode\*/\
*/\*.log | servicefabric /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.\*ServiceFabricMCNode\*/\
*/\*.xml | servicefabric /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.\*SfmcSetup\*/Events/\* | servicefabric /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.\*SfmcSetup\*/\*/\*.log | servicefabric /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.\*SfmcSetup\*/\*/\*.xml | servicefabric -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/Events/Boo
tstrapAgent_Temp/Raw/BootstrapAgent\*.log | diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/Events/Upg
radeAgent_Temp/Raw/UpgradeAgent\*.log | diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/FabricM
SIInstall\*.log | agents, normal, vmdiagnostic, windowsupdate +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/Events/Boo
tstrapAgent_Temp/Raw/BootstrapAgent\*.log | diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/Events/Upg
radeAgent_Temp/Raw/UpgradeAgent\*.log | diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/FabricM
SIInstall\*.log | agents, normal, windowsupdate /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/Infrast
ructureManifest.xml | agents, diagnostic, normal, vmdiagnostic, windowsupdate /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/TempClu
sterManifest.xml | agents, diagnostic, normal, vmdiagnostic, windowsupdate -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/VCRunti
meInstall\*.log | agents, normal, vmdiagnostic, windowsupdate -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/\*.log | diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/Event
s/BootstrapAgent_Temp/Raw/BootstrapAgent\*.log | diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/Event
s/UpgradeAgent_Temp/Raw/UpgradeAgent\*.log | diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/\*/In
frastructureManifest.xml | diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/\*/Te
mpClusterManifest.xml | diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/\*/\*
.log | diagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/VCRunti
meInstall\*.log | agents, normal, windowsupdate +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/\*.log | diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/Event
s/BootstrapAgent_Temp/Raw/BootstrapAgent\*.log | diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/Event
s/UpgradeAgent_Temp/Raw/UpgradeAgent\*.log | diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/\*/In
frastructureManifest.xml | diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/\*/Te
mpClusterManifest.xml | diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/\*/\*
.log | diagnostic, vmdiagnostic /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.\*ServiceFabricNode\*/Events
/\* | servicefabric /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.\*ServiceFabricNode\*/\*/\*.
log | servicefabric /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.\*ServiceFabricNode\*/\*/\*.
xml | servicefabric -/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/\*
.log | agents, diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/lo
g_\* | agents, diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.RunCommandHandlerWindows/\*/\*.log | diagnostic +/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/\*
.log | agents, diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/lo
g_\* | agents, diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.RunCommandHandlerWindows/\*/\*.log | diagnostic, vmdiagnostic /WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.RunCommandWindows/\*/\*.log | diagnostic, vmdiagnostic -/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/\*.log | agents, diagnostic, normal -/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/log_\* | agents, diagnostic -/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.WindowsPatchExtension/\*/windowsUpdat
eLog/\* | diagnostic +/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/\*.log | agents, diagnostic, normal, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/log_\* | agents, diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.WindowsPatchExtension/\*/windowsUpdat
eLog/\* | diagnostic, vmdiagnostic /WindowsAzure/Logs/Plugins/Microsoft.Compute.BGInfo/\*/BGInfo\*.log | agents, diagnostic, normal, vmdiagnostic, windowsupdate /WindowsAzure/Logs/Plugins/Microsoft.Compute.CustomScriptExtension/\*/\*.log | diagnostic, vmdiagnostic, windowsupdate /WindowsAzure/Logs/Plugins/Microsoft.Compute.JsonADDomainExtension/\*/ADDomainExtensi
on.log | agents, diagnostic, normal, vmdiagnostic, windowsupdate /WindowsAzure/Logs/Plugins/Microsoft.Compute.VMAccessAgent/\*/JsonVMAccessExtension.l
og | agents, diagnostic, min-diagnostic, normal, vmdiagnostic, windowsupdate /WindowsAzure/Logs/Plugins/Microsoft.EnterpriseCloud.Monitoring.MicrosoftMonitoringAg
ent/\*/0.log | agents, diagnostic, normal, vmdiagnostic, windowsupdate /WindowsAzure/Logs/Plugins/Microsoft.ManagedIdentity.ManagedIdentityExtensionForWindo
ws/\*/RuntimeSettings/\*.xml | diagnostic, vmdiagnostic, windowsupdate -/WindowsAzure/Logs/Plugins/Microsoft.ManagedServices.ApplicationHealthWindows/\*/\*.l
og | diagnostic +/WindowsAzure/Logs/Plugins/Microsoft.ManagedServices.ApplicationHealthWindows/\*/\*.l
og | diagnostic, vmdiagnostic /WindowsAzure/Logs/Plugins/Microsoft.Powershell.DSC/\*/DSCLOG\*.json | agents, diagnostic, normal, vmdiagnostic, windowsupdate /WindowsAzure/Logs/Plugins/Microsoft.Powershell.DSC/\*/DscExtensionHandler\*.log | agents, diagnostic, normal, vmdiagnostic, windowsupdate /WindowsAzure/Logs/Plugins/Microsoft.SqlServer.Management.SqlIaaSAgent/\*/CommandExec
ution\*.log | sql-iaas @@ -704,7 +722,7 @@ File Path | Manifest /WindowsAzure/Logs/WaAppAgent.log | agents, diagnostic, eg, min-diagnostic, normal, site-recovery, vmdiagnostic, windowsupdate, workloadbackup /WindowsAzure/Logs/\*.log | monitor-mgmt /WindowsAzure/Logs/plugins/\*/\*/\*.log | monitor-mgmt -/WindowsAzure/ProxyAgent/Logs/\* | agents, diagnostic, normal +/WindowsAzure/ProxyAgent/Logs/\* | agents, diagnostic, min-diagnostic, normal, vmdiagnostic /WindowsAzure/config/\*.xml | agents, diagnostic, eg, normal, vmdiagnostic, windowsupdate /WindowsUpdateVerbose.etl | windowsupdate /k/\*.err | aks @@ -717,4 +735,4 @@ File Path | Manifest /k/kubeclusterconfig.json | aks /unattend.xml | diagnostic, eg, normal, vmdiagnostic, windowsupdate -*File was created by running [parse_manifest.py](../tools/parse_manifest.py) on `2024-11-07 23:24:30.047485`* \ No newline at end of file +*File was created by running [parse_manifest.py](../tools/parse_manifest.py) on `2025-01-28 13:30:44.157648`* \ No newline at end of file diff --git a/docs/manifest_content.md b/docs/manifest_content.md index c015707..967a49c 100644 --- a/docs/manifest_content.md +++ b/docs/manifest_content.md @@ -842,7 +842,23 @@ diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-ServiceFabric%4Opera diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-ServiceFabric-Lease%4Operational.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-ServiceFabric-Lease%4Admin.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Windows Azure.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Active Directory Web Services.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/DFS Replication.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/DNS Server.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Directory Service.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-CAPI2%4Operational.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker%4BitLocker Management.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker-DrivePreparationTool%4Opera
tional.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-CAPI2%4Operational.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-CodeIntegrity%4Operational.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-DNSServer%4Audit.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-DNS-Client%4Operational.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-DSC%4Operational.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-Apps%4Admin.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-Apps%4Operational.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-CloudCache%4Admin.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-CloudCache%4Operational.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-GroupPolicy%4Operational.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-PnPConfig%4Configuration.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-PnP%4Configuration.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-NdisImPlatform%4Operational.evtx @@ -850,14 +866,17 @@ diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-NetworkLocat diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-NetworkProfile%4Operational.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-NetworkProvider%4Operational.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-NlaSvc%4Operational.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-NTLM%4Operational.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Oper
ational.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Admi
n.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-RemoteDesktopSe
ssionManager%4Admin.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-SessionServices
%4Operational.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-Resource-Exhaustion-Detector%4Operati
onal.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-SmbClient%4Connectivity.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-SmbClient%4Security.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-SMBClient%4Operational.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-SMBServer%4Connectivity.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-SmbServer%4Security.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-SMBServer%4Operational.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-ServerManager%4Operational.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-TCPIP%4Operational.evtx @@ -871,6 +890,7 @@ diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServ diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServices-SessionBroker-Client
%4Operational.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServices-SessionBroker-Client
%4Admin.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-UserPnp%4DeviceInstall.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-User Profile Service%4Operational.evt
x diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-Windows Firewall With Advanced Securi
ty%4ConnectionSecurity.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-Windows Firewall With Advanced Securi
ty%4Firewall.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-WindowsUpdateClient%4Operational.evtx @@ -881,11 +901,10 @@ diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-WindowsAzure-Diagnos diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-WindowsAzure-Status%4GuestAgent.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-WindowsAzure-Status%4Plugins.evtx diagnostic | copy | /Windows/System32/winevt/Logs/MicrosoftAzureRecoveryServices-Replication.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/OpenSSH%4Admin.evtx +diagnostic | copy | /Windows/System32/winevt/Logs/OpenSSH%4Operational.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Security.evtx diagnostic | copy | /Windows/System32/winevt/Logs/Setup.evtx -diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-DSC%4Operational.evtx -diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker%4BitLocker Management.evtx -diagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker-DrivePreparationTool%4Opera
tional.evtx diagnostic | list | /AzureData/CustomData.bin diagnostic | copy | /Windows/Setup/State/State.ini diagnostic | copy | /Windows/Panther/WaSetup.xml @@ -1041,9 +1060,9 @@ diagnostic | copy | /Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationMana diagnostic | copy | /Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/RuntimeSett
ings/VMApp.lockfile diagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.WindowsPatchExtension/\*/windowsUpdat
eLog/\* diagnostic | copy | /Windows/servicing/sessions/sessions.xml -diagnostic | diskinfo | diagnostic | copy | /WindowsAzure/ProxyAgent/Logs/\* diagnostic | copy | /Windows/Logs/eBPF/committed/\* +diagnostic | diskinfo | eg | copy | /Windows/System32/winevt/Logs/System.evtx eg | copy | /Windows/System32/winevt/Logs/Application.evtx eg | copy | /Windows/System32/winevt/Logs/Microsoft-ServiceFabric%4Admin.evtx @@ -1161,6 +1180,11 @@ min-diagnostic | copy | /Windows/servicing/sessions/sessions.xml min-diagnostic | copy | /Windows/debug/NetSetup.log min-diagnostic | copy | /Windows/debug/DCPROMO.log min-diagnostic | copy | /Windows/debug/dcpromoui.log +min-diagnostic | copy | /Windows/Logs/CBS/\*.log +min-diagnostic | copy | /Windows/Logs/DISM/\*.log +min-diagnostic | copy | /Windows/windowsupdate\*.log +min-diagnostic | copy | /WindowsAzure/ProxyAgent/Logs/\* +min-diagnostic | copy | /Windows/Logs/eBPF/committed/\* min-diagnostic | diskinfo | monitor-mgmt | copy | /Program Files/Microsoft Monitoring Agent/Agent/Health Service State/Management Packs
/\*.xml monitor-mgmt | copy | /Program Files/Microsoft Monitoring Agent/Agent/Health Service State/CT_\*/work/Servi
ceState/\*.log @@ -1453,7 +1477,23 @@ vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-ServiceFabric%4Ope vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-ServiceFabric-Lease%4Operational.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-ServiceFabric-Lease%4Admin.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Windows Azure.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Active Directory Web Services.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/DFS Replication.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/DNS Server.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Directory Service.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-CAPI2%4Operational.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker%4BitLocker Management.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker-DrivePreparationTool%4Opera
tional.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-CAPI2%4Operational.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-CodeIntegrity%4Operational.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-DNSServer%4Audit.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-DNS-Client%4Operational.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-DSC%4Operational.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-Apps%4Admin.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-Apps%4Operational.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-CloudCache%4Admin.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-CloudCache%4Operational.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-GroupPolicy%4Operational.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-PnPConfig%4Configuration.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-PnP%4Configuration.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-NdisImPlatform%4Operational.evtx @@ -1461,14 +1501,17 @@ vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-NetworkLoc vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-NetworkProfile%4Operational.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-NetworkProvider%4Operational.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-NlaSvc%4Operational.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-NTLM%4Operational.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Oper
ational.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Admi
n.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-RemoteDesktopSe
ssionManager%4Admin.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-SessionServices
%4Operational.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-Resource-Exhaustion-Detector%4Operati
onal.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-SmbClient%4Connectivity.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-SmbClient%4Security.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-SMBClient%4Operational.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-SMBServer%4Connectivity.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-SmbServer%4Security.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-SMBServer%4Operational.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-ServerManager%4Operational.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-TCPIP%4Operational.evtx @@ -1482,6 +1525,7 @@ vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-TerminalSe vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServices-SessionBroker-Client
%4Operational.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServices-SessionBroker-Client
%4Admin.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-UserPnp%4DeviceInstall.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-User Profile Service%4Operational.evt
x vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-Windows Firewall With Advanced Securi
ty%4ConnectionSecurity.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-Windows Firewall With Advanced Securi
ty%4Firewall.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-WindowsUpdateClient%4Operational.evtx @@ -1492,11 +1536,10 @@ vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-WindowsAzure-Diagn vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-WindowsAzure-Status%4GuestAgent.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-WindowsAzure-Status%4Plugins.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/MicrosoftAzureRecoveryServices-Replication.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/OpenSSH%4Admin.evtx +vmdiagnostic | copy | /Windows/System32/winevt/Logs/OpenSSH%4Operational.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Security.evtx vmdiagnostic | copy | /Windows/System32/winevt/Logs/Setup.evtx -vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-DSC%4Operational.evtx -vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker%4BitLocker Management.evtx -vmdiagnostic | copy | /Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker-DrivePreparationTool%4Opera
tional.evtx vmdiagnostic | list | /AzureData/CustomData.bin vmdiagnostic | copy | /Windows/Setup/State/State.ini vmdiagnostic | copy | /Windows/Panther/WaSetup.xml @@ -1552,10 +1595,24 @@ vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.Diagnostics.Iaa vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.Diagnostics.IaaSDiagnostics/\*/Diagnostics
PluginLauncher.log vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.Security.IaaSAntimalware/\*/AntimalwareCon
fig.log vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.Security.Monitoring/\*/AsmExtension.log -vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/FabricM
SIInstall\*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.ServiceFabricMCNode/\*/\*
.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.ServiceFabricMCNode/Event
s/sfmcnodeagent_Temp/Raw/sfmcnodeagent\*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.ServiceFabricMCNode-
Test/\*/\*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.ServiceFabricMCNode-
Test/Events/sfmcnodeagent_Temp/Raw/sfmcnodeagent\*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.SfmcSetup/\*/\*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.SfmcSetup/Events/sfmcsetu
pextagent_Temp/Raw/sfmcsetupextagent\*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.SfmcSetup-Test/\*/\*
.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.SfmcSetup-Test/Event
s/sfmcsetupextagent_Temp/Raw/sfmcsetupextagent\*.log vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/Infrast
ructureManifest.xml vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/TempClu
sterManifest.xml -vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/VCRunti
meInstall\*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/\*/\*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/Events/Boo
tstrapAgent_Temp/Raw/BootstrapAgent\*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/Events/Upg
radeAgent_Temp/Raw/UpgradeAgent\*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/\*/In
frastructureManifest.xml +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/\*/Te
mpClusterManifest.xml +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/\*/\*
.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/Event
s/BootstrapAgent_Temp/Raw/BootstrapAgent\*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/Event
s/UpgradeAgent_Temp/Raw/UpgradeAgent\*.log vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Compute.BGInfo/\*/BGInfo\*.log vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Compute.JsonADDomainExtension/\*/ADDomainExtensi
on.log vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Compute.VMAccessAgent/\*/JsonVMAccessExtension.l
og @@ -1613,6 +1670,7 @@ vmdiagnostic | copy | /Packages/Plugins/Microsoft.Powershell.DSC/\*/DSCVersion.x vmdiagnostic | copy | /Packages/Plugins/Microsoft.Powershell.DSC/\*/DSCWork/HotfixInstallInProgress.dsc vmdiagnostic | copy | /Packages/Plugins/Microsoft.Powershell.DSC/\*/DSCWork/PreInstallDone.dsc vmdiagnostic | copy | /Packages/Plugins/Microsoft.SqlServer.Management.SqlIaaSAgent/\*/PackageDefinition.xm
l +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.ManagedServices.ApplicationHealthWindows/\*/\*.l
og vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.NetworkWatcher.Edp.NetworkWatcherAgentWind
ows/\*/\*.txt vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.NetworkWatcher.Edp.NetworkWatcherAgentWind
ows/\*/\*.log vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.NetworkWatcher.NetworkWatcherAgentWindows/
\*/\*.txt @@ -1621,10 +1679,24 @@ vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.ManagedIdentity.Manag vmdiagnostic | copy | /WindowsAzure/GuestAgent\*/CommonAgentConfig.config vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Compute.CustomScriptExtension/\*/\*.log vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.RunCommandWindows/\*/\*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.RunCommandHandlerWindows/\*/\*.log vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ActiveDirectory.AADLoginForWindows/\*/\*.l
og vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.ActiveDirectory.AADLoginForWindows/\*/\*.t
xt vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.Azure.Security.AzureDiskEncryption/\*/BitlockerE
xtension.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/\*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/log_\* +vmdiagnostic | copy | /Packages/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/RuntimeSettings
/applicationRegistry.active +vmdiagnostic | copy | /Packages/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/RuntimeSettings
/applicationRegistry.backup +vmdiagnostic | copy | /Packages/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/RuntimeSettings
/VMApp.lockfile +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/\*
.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/lo
g_\* +vmdiagnostic | copy | /Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/RuntimeSett
ings/applicationRegistry.active +vmdiagnostic | copy | /Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/RuntimeSett
ings/applicationRegistry.backup +vmdiagnostic | copy | /Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/RuntimeSett
ings/VMApp.lockfile +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.WindowsPatchExtension/\*/windowsUpdat
eLog/\* vmdiagnostic | copy | /Windows/servicing/sessions/sessions.xml +vmdiagnostic | copy | /WindowsAzure/ProxyAgent/Logs/\* +vmdiagnostic | copy | /Windows/Logs/eBPF/committed/\* vmdiagnostic | diskinfo | windowsupdate | copy | /Boot/BCD windowsupdate | copy | /Windows/System32/config/SOFTWARE @@ -1886,4 +1958,4 @@ workloadbackup | copy | /WindowsAzure/Logs/Plugins/\* workloadbackup | copy | /WindowsAzure/Logs/AggregateStatus/aggregatestatus\*.json workloadbackup | copy | /WindowsAzure/Logs/AppAgentRuntime.log -*File was created by running [parse_manifest.py](../tools/parse_manifest.py) on `2024-11-07 23:24:30.047485`* \ No newline at end of file +*File was created by running [parse_manifest.py](../tools/parse_manifest.py) on `2025-01-28 13:30:44.157648`* \ No newline at end of file diff --git a/manifests/windows/diagnostic b/manifests/windows/diagnostic index 089545b..ccadca1 100644 --- a/manifests/windows/diagnostic +++ b/manifests/windows/diagnostic @@ -13,7 +13,23 @@ copy,/Windows/System32/winevt/Logs/Microsoft-ServiceFabric-Lease%4Admin.evtx copy,/Windows/System32/winevt/Logs/Windows Azure.evtx echo,### Additional Event Logs ### +copy,/Windows/System32/winevt/Logs/Active Directory Web Services.evtx +copy,/Windows/System32/winevt/Logs/DFS Replication.evtx +copy,/Windows/System32/winevt/Logs/DNS Server.evtx +copy,/Windows/System32/winevt/Logs/Directory Service.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-CAPI2%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker%4BitLocker Management.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker-DrivePreparationTool%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-CAPI2%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-CodeIntegrity%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-DNSServer%4Audit.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-DNS-Client%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-DSC%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-Apps%4Admin.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-Apps%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-CloudCache%4Admin.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-CloudCache%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-GroupPolicy%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-PnPConfig%4Configuration.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-PnP%4Configuration.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-NdisImPlatform%4Operational.evtx @@ -21,14 +37,17 @@ copy,/Windows/System32/winevt/Logs/Microsoft-Windows-NetworkLocationWizard%4Oper copy,/Windows/System32/winevt/Logs/Microsoft-Windows-NetworkProfile%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-NetworkProvider%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-NlaSvc%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-NTLM%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Admin.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-RemoteDesktopSessionManager%4Admin.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-SessionServices%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-SmbClient%4Connectivity.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-SmbClient%4Security.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-SMBClient%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-SMBServer%4Connectivity.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-SmbServer%4Security.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-SMBServer%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-ServerManager%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-TCPIP%4Operational.evtx @@ -42,6 +61,7 @@ copy,/Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServices-RemoteConn copy,/Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServices-SessionBroker-Client%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServices-SessionBroker-Client%4Admin.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-UserPnp%4DeviceInstall.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-User Profile Service%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-WindowsUpdateClient%4Operational.evtx @@ -52,11 +72,12 @@ copy,/Windows/System32/winevt/Logs/Microsoft-WindowsAzure-Diagnostics%4Bootstrap copy,/Windows/System32/winevt/Logs/Microsoft-WindowsAzure-Status%4GuestAgent.evtx copy,/Windows/System32/winevt/Logs/Microsoft-WindowsAzure-Status%4Plugins.evtx copy,/Windows/System32/winevt/Logs/MicrosoftAzureRecoveryServices-Replication.evtx +copy,/Windows/System32/winevt/Logs/OpenSSH%4Admin.evtx +copy,/Windows/System32/winevt/Logs/OpenSSH%4Operational.evtx copy,/Windows/System32/winevt/Logs/Security.evtx copy,/Windows/System32/winevt/Logs/Setup.evtx -copy,/Windows/System32/winevt/Logs/Microsoft-Windows-DSC%4Operational.evtx -copy,/Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker%4BitLocker Management.evtx -copy,/Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker-DrivePreparationTool%4Operational.evtx + + echo,### Provisioning ### ll,/AzureData/CustomData.bin @@ -225,9 +246,9 @@ copy,/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.WindowsPatchExtension/*/win echo,### Servicing ### copy,/Windows/servicing/sessions/sessions.xml,noscan -echo,### Gathering Disk Info ### -diskinfo, - echo,### Gathering Guest ProxyAgent Log Files ### copy,/WindowsAzure/ProxyAgent/Logs/* -copy,/Windows/Logs/eBPF/committed/* \ No newline at end of file +copy,/Windows/Logs/eBPF/committed/* + +echo,### Gathering Disk Info ### +diskinfo, \ No newline at end of file diff --git a/manifests/windows/min-diagnostic b/manifests/windows/min-diagnostic index 1cb7f20..fc2ecf9 100644 --- a/manifests/windows/min-diagnostic +++ b/manifests/windows/min-diagnostic @@ -40,5 +40,14 @@ copy,/Windows/debug/NetSetup.log copy,/Windows/debug/DCPROMO.log copy,/Windows/debug/dcpromoui.log +echo,### Windows Update ### +copy,/Windows/Logs/CBS/*.log +copy,/Windows/Logs/DISM/*.log +copy,/Windows/windowsupdate*.log + +echo,### Gathering Guest ProxyAgent Log Files ### +copy,/WindowsAzure/ProxyAgent/Logs/* +copy,/Windows/Logs/eBPF/committed/* + echo,### Gathering Disk Info ### diskinfo, diff --git a/manifests/windows/vmdiagnostic b/manifests/windows/vmdiagnostic index 450eb8e..0c06a2f 100644 --- a/manifests/windows/vmdiagnostic +++ b/manifests/windows/vmdiagnostic @@ -13,7 +13,23 @@ copy,/Windows/System32/winevt/Logs/Microsoft-ServiceFabric-Lease%4Admin.evtx copy,/Windows/System32/winevt/Logs/Windows Azure.evtx echo,### Additional Event Logs ### +copy,/Windows/System32/winevt/Logs/Active Directory Web Services.evtx +copy,/Windows/System32/winevt/Logs/DFS Replication.evtx +copy,/Windows/System32/winevt/Logs/DNS Server.evtx +copy,/Windows/System32/winevt/Logs/Directory Service.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-CAPI2%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker%4BitLocker Management.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker-DrivePreparationTool%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-CAPI2%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-CodeIntegrity%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-DNSServer%4Audit.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-DNS-Client%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-DSC%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-Apps%4Admin.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-Apps%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-CloudCache%4Admin.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-FSLogic-CloudCache%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-GroupPolicy%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-PnPConfig%4Configuration.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-PnP%4Configuration.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-NdisImPlatform%4Operational.evtx @@ -21,14 +37,17 @@ copy,/Windows/System32/winevt/Logs/Microsoft-Windows-NetworkLocationWizard%4Oper copy,/Windows/System32/winevt/Logs/Microsoft-Windows-NetworkProfile%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-NetworkProvider%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-NlaSvc%4Operational.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-NTLM%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Admin.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-RemoteDesktopSessionManager%4Admin.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-RemoteDesktopServices-SessionServices%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-SmbClient%4Connectivity.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-SmbClient%4Security.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-SMBClient%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-SMBServer%4Connectivity.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-SmbServer%4Security.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-SMBServer%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-ServerManager%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-TCPIP%4Operational.evtx @@ -42,6 +61,7 @@ copy,/Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServices-RemoteConn copy,/Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServices-SessionBroker-Client%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServices-SessionBroker-Client%4Admin.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-UserPnp%4DeviceInstall.evtx +copy,/Windows/System32/winevt/Logs/Microsoft-Windows-User Profile Service%4Operational.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx copy,/Windows/System32/winevt/Logs/Microsoft-Windows-WindowsUpdateClient%4Operational.evtx @@ -52,11 +72,10 @@ copy,/Windows/System32/winevt/Logs/Microsoft-WindowsAzure-Diagnostics%4Bootstrap copy,/Windows/System32/winevt/Logs/Microsoft-WindowsAzure-Status%4GuestAgent.evtx copy,/Windows/System32/winevt/Logs/Microsoft-WindowsAzure-Status%4Plugins.evtx copy,/Windows/System32/winevt/Logs/MicrosoftAzureRecoveryServices-Replication.evtx +copy,/Windows/System32/winevt/Logs/OpenSSH%4Admin.evtx +copy,/Windows/System32/winevt/Logs/OpenSSH%4Operational.evtx copy,/Windows/System32/winevt/Logs/Security.evtx copy,/Windows/System32/winevt/Logs/Setup.evtx -copy,/Windows/System32/winevt/Logs/Microsoft-Windows-DSC%4Operational.evtx -copy,/Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker%4BitLocker Management.evtx -copy,/Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker-DrivePreparationTool%4Operational.evtx echo,### Provisioning ### ll,/AzureData/CustomData.bin @@ -122,10 +141,24 @@ copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.Diagnostics.IaaSDiagnostics/*/Di copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.Diagnostics.IaaSDiagnostics/*/DiagnosticsPluginLauncher.log copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.Security.IaaSAntimalware/*/AntimalwareConfig.log copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.Security.Monitoring/*/AsmExtension.log -copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/*/FabricMSIInstall*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.ServiceFabricMCNode/*/*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.ServiceFabricMCNode/Events/sfmcnodeagent_Temp/Raw/sfmcnodeagent*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.ServiceFabricMCNode-Test/*/*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.ServiceFabricMCNode-Test/Events/sfmcnodeagent_Temp/Raw/sfmcnodeagent*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.SfmcSetup/*/*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.SfmcSetup/Events/sfmcsetupextagent_Temp/Raw/sfmcsetupextagent*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.SfmcSetup-Test/*/*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.MC.Test.SfmcSetup-Test/Events/sfmcsetupextagent_Temp/Raw/sfmcsetupextagent*.log copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/*/InfrastructureManifest.xml copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/*/TempClusterManifest.xml -copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/*/VCRuntimeInstall*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/*/*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/Events/BootstrapAgent_Temp/Raw/BootstrapAgent*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.ServiceFabricNode/Events/UpgradeAgent_Temp/Raw/UpgradeAgent*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/*/InfrastructureManifest.xml +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/*/TempClusterManifest.xml +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/*/*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/Events/BootstrapAgent_Temp/Raw/BootstrapAgent*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ServiceFabric.Test.ServiceFabricNode/Events/UpgradeAgent_Temp/Raw/UpgradeAgent*.log copy,/WindowsAzure/Logs/Plugins/Microsoft.Compute.BGInfo/*/BGInfo*.log copy,/WindowsAzure/Logs/Plugins/Microsoft.Compute.JsonADDomainExtension/*/ADDomainExtension.log copy,/WindowsAzure/Logs/Plugins/Microsoft.Compute.VMAccessAgent/*/JsonVMAccessExtension.log @@ -183,6 +216,7 @@ copy,/Packages/Plugins/Microsoft.Powershell.DSC/*/DSCVersion.xml copy,/Packages/Plugins/Microsoft.Powershell.DSC/*/DSCWork/HotfixInstallInProgress.dsc copy,/Packages/Plugins/Microsoft.Powershell.DSC/*/DSCWork/PreInstallDone.dsc copy,/Packages/Plugins/Microsoft.SqlServer.Management.SqlIaaSAgent/*/PackageDefinition.xml +copy,/WindowsAzure/Logs/Plugins/Microsoft.ManagedServices.ApplicationHealthWindows/*/*.log copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.NetworkWatcher.Edp.NetworkWatcherAgentWindows/*/*.txt copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.NetworkWatcher.Edp.NetworkWatcherAgentWindows/*/*.log copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.NetworkWatcher.NetworkWatcherAgentWindows/*/*.txt @@ -191,12 +225,28 @@ copy,/WindowsAzure/Logs/Plugins/Microsoft.ManagedIdentity.ManagedIdentityExtensi copy,/WindowsAzure/GuestAgent*/CommonAgentConfig.config copy,/WindowsAzure/Logs/Plugins/Microsoft.Compute.CustomScriptExtension/*/*.log copy,/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.RunCommandWindows/*/*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.RunCommandHandlerWindows/*/*.log copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ActiveDirectory.AADLoginForWindows/*/*.log copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.ActiveDirectory.AADLoginForWindows/*/*.txt copy,/WindowsAzure/Logs/Plugins/Microsoft.Azure.Security.AzureDiskEncryption/*/BitlockerExtension.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/*/*.log,noscan +copy,/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/*/log_* +copy,/Packages/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/*/RuntimeSettings/applicationRegistry.active +copy,/Packages/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/*/RuntimeSettings/applicationRegistry.backup +copy,/Packages/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/*/RuntimeSettings/VMApp.lockfile,noscan +copy,/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/*/*.log,noscan +copy,/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/*/log_* +copy,/Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/*/RuntimeSettings/applicationRegistry.active +copy,/Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/*/RuntimeSettings/applicationRegistry.backup +copy,/Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/*/RuntimeSettings/VMApp.lockfile,noscan +copy,/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.WindowsPatchExtension/*/windowsUpdateLog/* echo,### Servicing ### copy,/Windows/servicing/sessions/sessions.xml,noscan +echo,### Gathering Guest ProxyAgent Log Files ### +copy,/WindowsAzure/ProxyAgent/Logs/* +copy,/Windows/Logs/eBPF/committed/* + echo,### Gathering Disk Info ### diskinfo, From d4e1408b8c65afca2c6b81e89b6315c29c2907d0 Mon Sep 17 00:00:00 2001 From: "Scott Roberts (Azure)" Date: Fri, 28 Feb 2025 09:30:09 -0800 Subject: [PATCH 2/4] Updated output files --- docs/manifest_by_file.md | 2 +- docs/manifest_content.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/manifest_by_file.md b/docs/manifest_by_file.md index f489edf..ae85dc7 100644 --- a/docs/manifest_by_file.md +++ b/docs/manifest_by_file.md @@ -735,4 +735,4 @@ File Path | Manifest /k/kubeclusterconfig.json | aks /unattend.xml | diagnostic, eg, normal, vmdiagnostic, windowsupdate -*File was created by running [parse_manifest.py](../tools/parse_manifest.py) on `2025-01-28 13:30:44.157648`* \ No newline at end of file +*File was created by running [parse_manifest.py](../tools/parse_manifest.py) on `2025-02-28 09:29:12.085107`* \ No newline at end of file diff --git a/docs/manifest_content.md b/docs/manifest_content.md index 967a49c..59c8e7f 100644 --- a/docs/manifest_content.md +++ b/docs/manifest_content.md @@ -1958,4 +1958,4 @@ workloadbackup | copy | /WindowsAzure/Logs/Plugins/\* workloadbackup | copy | /WindowsAzure/Logs/AggregateStatus/aggregatestatus\*.json workloadbackup | copy | /WindowsAzure/Logs/AppAgentRuntime.log -*File was created by running [parse_manifest.py](../tools/parse_manifest.py) on `2025-01-28 13:30:44.157648`* \ No newline at end of file +*File was created by running [parse_manifest.py](../tools/parse_manifest.py) on `2025-02-28 09:29:12.085107`* \ No newline at end of file From 3950c9cd8434c3a1963db91e75128a5454018060 Mon Sep 17 00:00:00 2001 From: "Scott Roberts (Azure)" Date: Mon, 3 Mar 2025 15:56:19 -0800 Subject: [PATCH 3/4] Reran ParseManifest --- docs/manifest_by_file.md | 6 +++++- docs/manifest_content.md | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/docs/manifest_by_file.md b/docs/manifest_by_file.md index bc9e319..5e87685 100644 --- a/docs/manifest_by_file.md +++ b/docs/manifest_by_file.md @@ -694,6 +694,10 @@ File Path | Manifest /WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/\*.log | agents, diagnostic, normal, vmdiagnostic /WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.VMApplicationManagerWindows/\*/log_\* | agents, diagnostic, vmdiagnostic /WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.WindowsPatchExtension/\*/windowsUpdat
eLog/\* | diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.CPlat.ProxyAgent.ProxyAgentWindows/\*/\*.log | agents, diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.CPlat.ProxyAgent.ProxyAgentWindowsARM64/\*/\*.lo
g | agents, diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.CPlat.ProxyAgent.ProxyAgentWindowsARM64Test/\*/\
*.log | agents, diagnostic, vmdiagnostic +/WindowsAzure/Logs/Plugins/Microsoft.CPlat.ProxyAgent.ProxyAgentWindowsTest/\*/\*.log | agents, diagnostic, vmdiagnostic /WindowsAzure/Logs/Plugins/Microsoft.Compute.BGInfo/\*/BGInfo\*.log | agents, diagnostic, normal, vmdiagnostic, windowsupdate /WindowsAzure/Logs/Plugins/Microsoft.Compute.CustomScriptExtension/\*/\*.log | diagnostic, vmdiagnostic, windowsupdate /WindowsAzure/Logs/Plugins/Microsoft.Compute.JsonADDomainExtension/\*/ADDomainExtensi
on.log | agents, diagnostic, normal, vmdiagnostic, windowsupdate @@ -735,4 +739,4 @@ File Path | Manifest /k/kubeclusterconfig.json | aks /unattend.xml | diagnostic, eg, normal, vmdiagnostic, windowsupdate -*File was created by running [parse_manifest.py](../tools/parse_manifest.py) on `2025-02-28 09:29:12.085107`* \ No newline at end of file +*File was created by running [parse_manifest.py](../tools/parse_manifest.py) on `2025-03-03 15:54:10.543166`* \ No newline at end of file diff --git a/docs/manifest_content.md b/docs/manifest_content.md index e97ecac..f75d9c3 100644 --- a/docs/manifest_content.md +++ b/docs/manifest_content.md @@ -1703,6 +1703,10 @@ vmdiagnostic | copy | /Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationMa vmdiagnostic | copy | /Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/RuntimeSett
ings/applicationRegistry.backup vmdiagnostic | copy | /Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/\*/RuntimeSett
ings/VMApp.lockfile vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.WindowsPatchExtension/\*/windowsUpdat
eLog/\* +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.CPlat.ProxyAgent.ProxyAgentWindowsTest/\*/\*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.CPlat.ProxyAgent.ProxyAgentWindows/\*/\*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.CPlat.ProxyAgent.ProxyAgentWindowsARM64Test/\*/\
*.log +vmdiagnostic | copy | /WindowsAzure/Logs/Plugins/Microsoft.CPlat.ProxyAgent.ProxyAgentWindowsARM64/\*/\*.lo
g vmdiagnostic | copy | /Windows/servicing/sessions/sessions.xml vmdiagnostic | copy | /WindowsAzure/ProxyAgent/Logs/\* vmdiagnostic | copy | /Windows/Logs/eBPF/committed/\* @@ -1967,4 +1971,4 @@ workloadbackup | copy | /WindowsAzure/Logs/Plugins/\* workloadbackup | copy | /WindowsAzure/Logs/AggregateStatus/aggregatestatus\*.json workloadbackup | copy | /WindowsAzure/Logs/AppAgentRuntime.log -*File was created by running [parse_manifest.py](../tools/parse_manifest.py) on `2025-02-28 09:29:12.085107`* \ No newline at end of file +*File was created by running [parse_manifest.py](../tools/parse_manifest.py) on `2025-03-03 15:54:10.543166`* \ No newline at end of file From 712a287b6b9cfaa972747c34143caee80f6f6ffa Mon Sep 17 00:00:00 2001 From: "Scott Roberts (Azure)" Date: Mon, 3 Mar 2025 15:56:32 -0800 Subject: [PATCH 4/4] Updated --- manifests/windows/vmdiagnostic | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/manifests/windows/vmdiagnostic b/manifests/windows/vmdiagnostic index 0c06a2f..d7ce2c5 100644 --- a/manifests/windows/vmdiagnostic +++ b/manifests/windows/vmdiagnostic @@ -240,6 +240,10 @@ copy,/Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/*/Ru copy,/Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/*/RuntimeSettings/applicationRegistry.backup copy,/Packages/Plugins/Microsoft.CPlat.Core.EDP.VMApplicationManagerWindows/*/RuntimeSettings/VMApp.lockfile,noscan copy,/WindowsAzure/Logs/Plugins/Microsoft.CPlat.Core.WindowsPatchExtension/*/windowsUpdateLog/* +copy,/WindowsAzure/Logs/Plugins/Microsoft.CPlat.ProxyAgent.ProxyAgentWindowsTest/*/*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.CPlat.ProxyAgent.ProxyAgentWindows/*/*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.CPlat.ProxyAgent.ProxyAgentWindowsARM64Test/*/*.log +copy,/WindowsAzure/Logs/Plugins/Microsoft.CPlat.ProxyAgent.ProxyAgentWindowsARM64/*/*.log echo,### Servicing ### copy,/Windows/servicing/sessions/sessions.xml,noscan