Windows Event Logs

This guide shows you how to collect Windows Event Logs and forward them to Sentry using the OpenTelemetry Collector with the Windows Event Log Receiver.

Prerequisites

Before you begin, ensure you have:

• A Windows Server or Windows machine (Windows Vista or later)
• A Microsoft user account with permissions to access the Windows Event Log
• A Microsoft user account with permissions to create Services (for running the collector as a service)
• A Sentry project to send data to

Step 1: Install the OpenTelemetry Collector

The Windows Event Log Receiver is included in the OpenTelemetry Collector Contrib distribution. You'll need to download and install this version, as the standard otelcol binary does not include the Windows Event Log Receiver.

Binary Installation

1. Download the latest otelcol-contrib binary from the OpenTelemetry Collector releases page.

2. Extract the binary to a directory, for example C:\otel-collector\.

3. Create the service using the following command in an elevated Command Prompt or PowerShell:

sc.exe create otelcol-contrib displayname=otelcol-contrib start=delayed-auto binPath="C:\otel-collector\otelcol-contrib.exe --config C:\otel-collector\config.yaml"

MSI Installation

Alternatively, you can install the OpenTelemetry Collector using the MSI installer:

1. Download the latest MSI installer from the OpenTelemetry Collector releases page.

2. Run the installer on your Windows Server.

3. The service named otelcol-contrib will be created and started automatically upon completion.

Step 2: Get Your Sentry OTLP Credentials

You'll need your Sentry OTLP endpoint and authentication header. These can be found in your Sentry Project Settings under Client Keys (DSN) > OpenTelemetry (OTLP).

Logs Endpoint

___OTLP_LOGS_URL___

Authentication Header

x-sentry-auth: sentry sentry_key=___PUBLIC_KEY___

Step 3: Configure the Collector

Create a configuration file at C:\otel-collector\config.yaml with the Windows Event Log Receiver and the OTLP HTTP exporter configured to send logs to Sentry.

Basic Configuration

This configuration collects logs from the three main Windows Event Log channels: Application, System, and Security.

receivers:
  windowseventlog/application:
    channel: application
  windowseventlog/system:
    channel: system
  windowseventlog/security:
    channel: security

processors:
  resourcedetection:
    detectors: [system]
    system:
      hostname_sources: ["os"]
  batch:
    send_batch_size: 1024
    send_batch_max_size: 2048
    timeout: "1s"

exporters:
  otlphttp/sentry:
    logs_endpoint: ___OTLP_LOGS_URL___
    headers:
      x-sentry-auth: "sentry sentry_key=___PUBLIC_KEY___"
    compression: gzip
    encoding: proto

service:
  pipelines:
    logs:
      receivers:
        - windowseventlog/application
        - windowseventlog/system
        - windowseventlog/security
      processors:
        - resourcedetection
        - batch
      exporters:
        - otlphttp/sentry

Configuration Options

The Windows Event Log Receiver supports several configuration options:

Filtering Events with XML Queries

You can use XML queries to filter specific events. This example only forwards logs from specific providers:

receivers:
  windowseventlog/filtered:
    query: |
      <QueryList>
        <Query Id="0">
          <Select Path="Application">*[System[Provider[@Name='MyApp']]]</Select>
          <Select Path="System">*[System[Level&lt;=2]]</Select>
        </Query>
      </QueryList>

The query above collects:

• All events from the MyApp provider in the Application channel
• Events with severity level 2 (Error) or lower from the System channel

For more information on XML query syntax, see Microsoft's Query Schema documentation.

Collecting from Remote Machines

You can collect Windows Event Logs from remote machines by configuring the remote option:

receivers:
  windowseventlog/remote:
    channel: application
    remote:
      server: "remote-server"
      username: "user"
      password: "password"
      domain: "domain"

Step 4: Start the Collector

Once you've created your configuration file, configure the restart settings and start the service:

sc.exe failure otelcol-contrib reset= 86400 actions= restart/5000/restart/5000/restart/5000
sc.exe start otelcol-contrib

Troubleshooting

If logs aren't appearing in Sentry, you can add a debug exporter to troubleshoot:

1. Stop the service:

sc.exe stop otelcol-contrib

2. Create a debug configuration file (config_debug.yaml) with a debug exporter:

receivers:
  windowseventlog/application:
    channel: application

processors:
  batch:

exporters:
  debug:
    verbosity: detailed
  otlphttp/sentry:
    logs_endpoint: ___OTLP_LOGS_URL___
    headers:
      x-sentry-auth: "sentry sentry_key=___PUBLIC_KEY___"
    compression: gzip
    encoding: proto

service:
  pipelines:
    logs:
      receivers:
        - windowseventlog/application
      processors:
        - batch
      exporters:
        - otlphttp/sentry
        - debug

3. Run the collector manually to see debug output:

C:\otel-collector\otelcol-contrib.exe --config C:\otel-collector\config_debug.yaml

4. Review the console output to verify events are being processed correctly.

5. If events are processed but not reaching Sentry, check:

   • Network connectivity to Sentry's ingestion endpoint
   • Firewall rules allowing outbound HTTPS traffic
   • The correctness of your Sentry credentials

Additional Resources

• Windows Event Log Receiver Documentation
• Sentry OpenTelemetry Collector Configuration
• Sentry Logs