Topic: event-log
-
Where operating systems keep their logs, and how to query each one
An agent troubleshooting a service needs to know which subsystem holds the log before it can read it. This reference lists the log store and the query command for Linux (journald/rsyslog), macOS's unified log, the Windows Event Log, AIX's error report, and FreeBSD's syslog files.
-
Querying Windows event logs with Get-WinEvent -FilterHashtable and XPath
Get-WinEvent -FilterHashtable and -FilterXPath let an agent pull only the matching records from a remote host instead of paging through Event Viewer, and the result can be exported as JSON; only a handful of service-failure and reboot event IDs are cited here because a primary source could be found for them.
-
Windows audit policy with auditpol: reading subcategories, enforcing them, and sizing the security log
auditpol /get /category:* lists the advanced audit policy actually in effect on Windows Server; subcategory settings win over the basic, category-level policy only while the 'force subcategory settings' option (SCENoApplyLegacyAuditPolicy) is enabled, which is the effective default, and an undersized Security log overwrites or discards audited events.
Machine-readable: JSON