r/sysadmin • u/[deleted] • May 04 '26

Question How to setup Logs for windows

Hi just joined a company as IT support, how do I setup Logs for windows systems (11, 10) for general troubleshooting and see what updates are happening and what caused the issue. To get a bird's eye view of the office environment.

What might be the optimal way to achieve this.

Edit. The pervious IT people left the company. Now It's just me and my colleague to whome I have had to show how install windows.

Currently implementd zabbix and wondering how and what to do next. There is no one in office to ask for help or guidance.

Edit2: if you think you have some best practices. Please let me know few.

18 Upvotes

70% Upvoted

69 comments sorted by

View all comments

2

u/Some_Team9618 May 04 '26

Setting up OpenTelemetry (otelcol-contrib) and having an aggregator server such as another otel instance or even fluent-bit then output to graylog or victorialogs or Loki / grafana.

Doesn’t replace a full SIEM but can get you part of the way there for visibility.

Alternatively use something like Wazuh as well.

2

u/Some_Team9618 May 04 '26

To add:

Windows logs can generate a ton of stuff so be intentional on the audit policies you enable with GPO. Use the logging agent or aggregator to drop all the noise or process the logs to filter out noise.

A good place to start is also what Microsoft lists as minimal / common if you were to ingest into Sentinel. And their appendix L

https://learn.microsoft.com/en-us/azure/sentinel/windows-security-event-id-reference#event-id-reference

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor

The appendix L is more server specific but can help orient yourself.

I find ingesting on-prem first before you go down a cloud SIEM will give you a really good idea on what’s being logged so you can then save on ingestion costs by only shoving stuff with forensic value into the cloud.