What deserves a look this hour
Ranked findings for the live or replayed hour — how bad, how much, how long, and where — with a drawer into the dictionary entry and the raw evidence. A missing hour fails closed; it never renders as calm.
Seventeen million events is not a search problem.
Event Intelligence sits inside the Azure Local operations platform and treats the forwarded Windows event firehose like a research problem, not a text box. A researched dictionary supplies meaning. Frozen analysis runs keep later arrivals from rewriting earlier evidence. And a quiet page has to prove it's quiet — a collector that stopped talking is a finding, not a calm afternoon.
Windows Event ForwardingEvent DictionarySQL Server 2025 regexFinding continuityCollection health
~17M
forwarded Windows events in a 36-day window
114
event providers researched into the dictionary
100+
SQL procedures behind the analysis engine
0
invented meanings for unmapped events
// The problem
A firehose is not a finding.
Windows Event Forwarding is honest about volume and almost silent about meaning. One node can emit hundreds of messages about a single fault; another fault shows up once and still matters. Providers reuse Event IDs, messages drift between OS builds, and a burst on one node is a different problem from the same signature across a whole cluster.
The platform already had a raw search over that stream. It's necessary, and it stops being enough the moment you need to know whether something is new, expected, recovering, or just poorly collected. The first temptation is to flatten everything into a pretty timeline and let an operator "zoom in." That looks like a product and behaves like a guilt trip. Event Intelligence starts from the opposite rule: if we don't have a researched meaning, we do not invent one — and silence is never treated as health.
// How it works
Dictionary first. Then a run you can replay.
Meaning is authored. Observations are captured. Conclusions stay attached to a frozen population.
01 COLLECT
Split forwarding subscriptions cover OS, clustering, Hyper-V, storage, and network channels, and the filtering happens there — not in the analysis. Coverage is a first-class fact: a missing channel stays missing, it never becomes a quiet zero.
02 DEFINE
The Event Dictionary — 114 researched providers — holds message variants, probable causes, extraction rules, and investigation guidance. The same Event ID can mean two different things, so meaning attaches to the variant. Definitions move candidate → validated → shadow → active, and a human review label never grants runtime activation by itself.
03 FREEZE
Every 30 minutes a rolling worker freezes a run: a source watermark plus the exact definition revisions it used. A later append cannot become evidence for an earlier run, and new research can't quietly rewrite what yesterday's analysis meant. Replay opens that frozen run, not today's data.
04 FOLLOW
Finding keys keep one signal alive across runs, so tomorrow's incident is the same finding as today's. A quiet ending is not recovery — recovery needs a later paired signal from the same system. Observed 30-day norms add context without rewriting the documented meaning.
// The interesting part
Honesty is the hard part, not the chart.
Most of the engine exists to stop a dashboard from lying under load.
What it will do
- Attach researched meaning only when a variant is selected
- Keep unmapped and ambiguous events as parsing-quality evidence
- Replay a run against the same watermark and definition hashes
- Carry a finding across runs without pretending it recovered
- Show coverage gaps instead of painting them green
What it will not do
- Invent a diagnosis so a tile isn't empty
- Let a later event rewrite an earlier analysis
- Treat "we saw this a lot" as "this is healthy"
- Confuse a quiet signal with proved recovery
- Hide a collector that stopped talking
// What was hard
Four problems that don't show up in a demo.
Each one looked finished before it was. The fixes are the design.
Seventeen million rows don't aggregate on demand. Full-table counts timed out at the two-minute query limit, so totals come from partition statistics and indexed probes. The worker materializes in 10,000-event keyset batches, spends at most fifteen minutes on catch-up, and holds five minutes back for the run itself. If the backlog still isn't cleared, it defers the analysis instead of publishing a half-read hour.
Silence has four explanations. Nothing happened, the collector is behind, the source is gone, or an expected signal never arrived. Those are four different states. Collection goes stale after three missed 45-minute cycles, a missing or disabled worker task is never reported healthy, and a heartbeat that doesn't arrive can become a finding of its own.
SQL Server 2025, for a boring reason. REGEXP_LIKE and REGEXP_SUBSTR pull typed entities out of a message only after the event is already selected by provider, ID, and time — regex is a bounded extraction tool, not a search box over the firehose. Preview features stay off, vector search stayed research, and the deploy script refuses to apply if the edition, compatibility level, or flags are wrong.
"Related" is not "caused." Nearby events, an overlapping backup window, or "often appears with" are labeled as leads. Only an exact payload match or a proven sequence may claim more, and the storage, the APIs, and the UI wording all keep those evidence classes apart. Ask ALDHI can read this plane, but it can't invent a meaning the dictionary didn't earn — and a chat answer doesn't replace a saved analysis.
// Operator surfaces
What you actually look at.
No screenshots — the views, in words.
Events that matter at any rate
Restarts, service failures, VM resets, and admin-authored matchers, grouped into episodes from 12 hours to 7 days — whether or not the fleet-wide rate looks unusual.
Who's unhealthy, and who can't report
Every node and cluster through pressure, coverage, and reporting lenses, so you narrow the scope before concluding anything.
Start from the clue you already have
Pivot from a signal, an extracted entity, or a raw event; look back through storm episodes and recurring findings. The same analysis shows up as summary cards on every cluster and node page.