Skip to content
This repository was archived by the owner on Feb 21, 2021. It is now read-only.

GettingStarted.md

Latest commit

 

History

History
84 lines (54 loc) · 3.37 KB

GettingStarted.md

File metadata and controls

84 lines (54 loc) · 3.37 KB

Getting Started with Real-Time KQL

This guide will walk you through the process of downloading and setting up the KqlTools suite for use on either a Windows or Linux machine. Start by downloading the appropriate files for your machine:

    

Jump To:

Windows

Prerequisites

  1. Install .NET Core SDK 3.1.200

Download and Setup

  1. Download and extract the program files for Windows. (You can also download the files using the link at the top of the page.)
  2. Open a Command Prompt as Administrator and navigate to the folder where you've extracted the files.
  3. Navigate into the win-x64 folder. This is the folder from which you will run Real-Time KQL.

Running Real-Time KQL

  1. From within the win-x64 folder, run the following command to get an overview of your options:
RealTimeKql --help
  1. For more information and examples on using Real-Time KQL for Windows:
    • winlog: OS or application logs you see in EventVwr or log file(s) on disk
    • etw: real-time session in Event Tracing for Windows (ETW) or previously recorded "Event Trace Log"

Linux

Prerequisites

Install .NET Core 3.1

  1. Add the Microsoft package signing key to your list of trusted keys and add the package repository. Open a terminal and run the following commands:
wget https://packages.microsoft.com/config/ubuntu/20.04/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
sudo dpkg -i packages-microsoft-prod.deb
  1. Install the .NET SDK:
sudo apt-get update; \
  sudo apt-get install -y apt-transport-https && \
  sudo apt-get update && \
  sudo apt-get install -y dotnet-sdk-3.1

Download and Setup

  1. Download and extract the program files for Linux. (You can also download the files using the link at the top of the page.)
  2. Open a terminal window and navigate to the folder where you've extracted the files.
  3. Navigate into the RealTimeKql-linux-TestRelease folder. This is the folder from which you will run Real-Time KQL.

Running Real-Time KQL

  1. From within the RealTimeKql-linux-TestRelease folder, run the following command to get an overview of your options:
sudo ./RealTimeKql syslog --help
  1. For more information and examples on using Real-Time KQL for Linux, see the syslog guide.