I have configured Azure Diagnostic Extension and it works fine.
I can see WADWindowsEventLogsTable with event data.
As I can see RowKey format for these data is:
f4384921-7e24-4b71-9971-095352aa990d___IaaS____WindowsServer01___0000000004295488675
{Deployment Id}___IaaS____{Server Name}___{Timestamp}
Please pay attention in this format I see 4 underscores after "IaaS" prefix. But other places contains 3 underscores.
Also I have reviewed many links and I see always 3 underscores in the RowKey parts:
- https://dzone.com/articles/understanding-and-controlling
- https://novacontext.com/microsoft-azure-security-and-audit-log-management/index.html
- https://gauravmantri.com/2012/02/17/effective-way-of-fetching-diagnostics-data-from-windows-azure-diagnostics-table-hint-use-partitionkey/
Unfortunately all links that I have found it is not official Microsoft documentation. I can't find official documentation about correct format for this data. And I'm afraid sometimes used 3 underscores (as example for ScaleSets or CloudRoles) and sometimes used 4 underscores (as example for ARM VM).
I need to develop universal code for all possible situations. So for me it is very critical understand correct RowKey format.
For me it is very strange why only after "IaaS" prefix I see 4 underscores.
Could someone explain what format for RowKey is correct?
Thanks for any help.