Windows Event Log Monitor

Windows Event Log Monitor works with .NET Agent Extension Manager to capture and report specific windows events.


Windows Event Log monitor require extension.xml file to be placed in a new folder under <Extension Manager Root Directory>/Extensions


  • .NET Agent Extension Manager, can be downloaded from here
  • The AppDynamics .NET Agent
  • .NET 4.0 or later


Download and copy extension.xml in a new folder under Extensions directory of .Net Extension Manager. Please refer to the next section for detailed steps.

Getting Started

  1. Create a new folder under Extension Manager root directory. We can name it according to type of events we want to capture like IISEventMonitor or simply WindowsEventMonitor
  1. Copy extension.xml to this folder.
  1. Edit extension.xml to provide controller details and target specific events.
    • Change the name of extension if required. (It will take the folder name if we leave it blank.)
      <extension type="Event" name="WindowsEventLogMonitor" enabled="true">
    • Provide controller user credentials. These are required for publishing custom events to the controller. For single-tenant controllers, use "customer1" for the account. Controller host/port are read from the Agent Configuration file (config.xml).
      <controller-info user="username" account="customer1" password="password" />
    • Associate event to any business transaction, node or tier. This is optional and if we leave these commented then the event will be associated with application only.
          <add key="bt" value="/MyBT.aspx"></add>
          <add key="node" value="MyNodeName"></add>
          <add key="tier" value="MyTier"></add>
      NOTE: The node, BT, and Tier names must match an existing Tier/Node/BT exactly, or an error will be generated and event will not be registered. Also valid property combination are : Only Tier, BT+Tier, Node+Tier, BT+Node+Tier.
    • Specify filters to target any event(s) using following parameters:
      • EventLogPath: Possible values are Application, System, Setup. If we remove this parameter then by default it will look in System.
      • EventSources: We can provide any event source. Multiple values can be provided as comma separated strings.
      • EventID: We can provide any event Id. Multiple values can be provided as comma separated strings. This parameter can be left empty or commented.
      • EventLogEntryType: Possible values are Error, Information or Warning. By defualt it will only report Error.
      • EventID: We can provide any strings to be matched in event message. Multiple values can be provided as comma separated strings. This parameter can be left empty or commented.
  1. Save the file and launch Extension Manager UI. We should be able to see WindowsEventMonitor extension listed under "List of extensions loaded"
  1. Start Extension Service, if it was stopped or Restart for the changes to take effect.
    • We will see new custom events sent to the controller. We should be able to view link to Custom Events on Application Dashboard. For more details


If you're not seeing events reported to the controller, check to make sure the controller credentials are correct and try removing node/tier or BT mapping if added. If this doesn't help, check the Logs folder for any errors.


  1. Upgrade to latest version of extension manager.
  2. Copy new extension.xml and make appropriate changes.
  3. Start Extension Service to use latest version.