WSL commands/processes logging to event viewer

[c3101]

More of a question than an issue, but can't find any reference....

Is is possible for the WSL to log all user executed processes to the windows logging subsystem, either for shipping to a SIEM, ATA, ATP or similar?

[lewisdonofrio]

you'll need to do the syslog to (im_msvistalog) eventlog from https://www.loggly.com/ultimate-guide/centralizing-windows-logs/ or use splunk or some type of central logging system. keep in context I'm just guessing here....

[craigloewen-msft]

Hi @c3101 ,

I believe you can do this with command line auditing.

Here is a blog post on how to set up command line auditing for the Windows Console, and you can use the info there to help log process creation and filter down to see what was running in WSL. :)

[Biswa96]

Isn't the easiest way to parse the event logs from LxCore. Details here: https://github.com/Microsoft/WSL/blob/master/CONTRIBUTING.md#8-detailed-logs

[therealkenc]

Looks like this got all the answers forthcoming.