Obs/bin/MAWatchdog/AddOnInfraMAConfig.xml

<?xml version="1.0" encoding="utf-8"?>
<MonitoringManagement version="1.0" namespace="AddOnInfra" eventVersion="6" timestamp="2013-02-01T00:00:00.000">
  <!-- This config is based on MA/MDS config 2.0. Full schema Wiki @ http://sharepoint/sites/AzMon/MonWiki/Wiki%20Pages/Config%202.0%20Doc.aspx -->
  <Imports>
    <Import file="CommonSecurityAudit.xml" />
    <Import file="CommonSecurityAuditEx.xml" />
  </Imports>
  <Accounts>
    <Account moniker="addoninframoniker" alias="AuditStore"/>
  </Accounts>
  <Management eventVolume="Medium" defaultRetentionInDays="90">
    <Identity>
      <IdentityComponent name="Tenant">GetEnvironmentVariable("MONITORING_TENANT")</IdentityComponent>
      <IdentityComponent name="Role">GetEnvironmentVariable("MONITORING_ROLE")</IdentityComponent>
      <IdentityComponent name="RoleInstance">GetEnvironmentVariable("MONITORING_ROLE_INSTANCE")</IdentityComponent>
    </Identity>
    <AgentResourceUsage cpuPercentUsage="10" cpuThrottling="true" memoryLimitInMB="1000" memoryThrottling="true" diskQuotaInMB="10000" >
       <ExtensionResourceUsage cpuPercentUsage="10" cpuThrottling="true" memoryLimitInMB="500" memoryThrottling="true" />
    </AgentResourceUsage>
  </Management>
  <Events>
    <EtwProviders>
     <EtwProvider name="Microsoft-MAStorageAccountPruner-DataPruner" format="EventSource" storeType="CentralBond" duration="PT20M">
       <Event id="10" eventName="DataPruner"/>
       <Event id="11" eventName="DataPruner"/>
       <Event id="12" eventName="DataPruner"/>
       <Event id="13" eventName="DataPruner"/>
       <Event id="100" eventName="DataPruner"/>
       <Event id="101" eventName="DataPruner"/>
       <Event id="102" eventName="DataPruner"/>
       <Event id="200" eventName="DataPruner"/>
     </EtwProvider>
      <EtwProvider name="Microsoft-ServiceFabric-Monitoring-Health" format="EventSource" storeType="CentralBond" duration="PT20M">
        <!-- This section defines how the MA collects the EventSource events emitted by the MonitoringService.
             The ID for each event must match the value emitted from the service. -->
        <!-- HealthState events -->
        <Event id="1" eventName="ClusterHealthState"/>
        <Event id="2" eventName="AppHealthState"/>
        <Event id="3" eventName="NodeHealthState"/>
        <Event id="4" eventName="ServiceHealthState"/>
        <Event id="5" eventName="PartitionHealthState"/>
        <Event id="6" eventName="ReplicaHealthState"/>
        <Event id="7" eventName="DeployedApplicationHealthState"/>
        <Event id="8" eventName="DeployedServicePackageHealthState"/>
        <!-- HealthEvent events -->
        <Event id="9" eventName="ClusterHealthEvent"/>
        <Event id="10" eventName="AppHealthEvent"/>
        <Event id="11" eventName="NodeHealthEvent"/>
        <Event id="12" eventName="ServiceHealthEvent"/>
        <Event id="13" eventName="PartitionHealthEvent"/>
        <Event id="14" eventName="ReplicaHealthEvent"/>
        <Event id="15" eventName="DeployedApplicationHealthEvent"/>
        <Event id="16" eventName="DeployedServicePackageHealthEvent"/>
      </EtwProvider>
      <!-- Events emitted by Service Fabric Actors framework -->
      <EtwProvider name="Microsoft-ServiceFabric-Actors" format="EventSource" storeType="CentralBond" duration="PT20M">
        <DefaultEvent eventName="ServiceFabricReliableActorEvent"/>
      </EtwProvider>
       <!-- Events emitted by Service Fabric Reliable Service framework -->
      <EtwProvider name="Microsoft-ServiceFabric-Services" format="EventSource" storeType="CentralBond" duration="PT20M">
        <DefaultEvent eventName="ServiceFabricReliableServiceEvent"/>
      </EtwProvider>
      <!-- Operational events emitted by Service Fabric -->
      <EtwProvider guid="cbd93bc2-71e5-4566-b3a7-595d8eeca6e8" format="Manifest" keywordFilter="4611686018427387920" storeType="CentralBond" duration="PT20M">
        <DefaultEvent eventName="ServiceFabricOperationalEvent" />
      </EtwProvider>
      <!-- Events emitted by Service Fabric Monitoring Service -->
      <EtwProvider name="ServiceFabric-Monitoring-HealthService" format="EventSource" storeType="CentralBond" duration="PT20M">
        <DefaultEvent eventName="ServiceFabricMonitoringServiceEvent"/>
      </EtwProvider>
      <EtwProvider guid="a3693192-9ed6-46d2-a981-f8226c8363bd" format="EventSource" storeType="CentralBond" duration="PT20M">
        <Event id="0" eventName="ServiceFabricContainerConsoleEvent" />
      </EtwProvider>
    </EtwProviders>
    <FileMonitors storeType="CentralBond" >
     <FileWatchItem eventName="FileEvent"
                     filter="*"
                     deadline="PT10M"
                     compressionType="none"
                     retentionInDays="20"
                     directoryQuotaInMB = "100"
                     container="extensionlogs"
                     uploadDelayInSeconds="10">
        <Directory><![CDATA[Concat("", GetEnvironmentVariable("SystemDrive"), "\WindowsAzure\Logs")]]></Directory>
     </FileWatchItem>
     <FileWatchItem eventName="SFFileEvent"
                     filter="*"
                     deadline="PT10M"
                     compressionType="none"
                     retentionInDays="20"
                     directoryQuotaInMB = "100"
                     container="sfdiagnostics"
                     uploadDelayInSeconds="10">
        <Directory><![CDATA[Concat("", GetEnvironmentVariable("MONITORING_SF_DIAGNOSTICS"))]]></Directory>
     </FileWatchItem>
     <FileWatchItem eventName="SFSetupFileEvent"
                     filter="*"
                     deadline="PT10M"
                     compressionType="none"
                     retentionInDays="20"
                     directoryQuotaInMB = "100"
                     container="sfsetuplogs"
                     uploadDelayInSeconds="10">
        <Directory><![CDATA[Concat("", GetEnvironmentVariable("MONITORING_SF_SETUP_LOGS"))]]></Directory>
     </FileWatchItem>
     <FileWatchItem eventName="SFStandaloneLogs"
                     filter="*miscellaneousLogs.zip"
                     deadline="PT1M"
                     compressionType="none"
                     retentionInDays="20"
                     directoryQuotaInMB = "100"
                     container="sfstandalonelogs"
                     uploadDelayInSeconds="10">
        <Directory><![CDATA[Concat("", GetEnvironmentVariable("MONITORING_SF_STANDALONE_LOGS"))]]></Directory>
     </FileWatchItem>
     <FileWatchItem eventName="SFDscStatusLogs"
                     filter="*"
                     deadline="PT5M"
                     compressionType="none"
                     retentionInDays="20"
                     directoryQuotaInMB = "100"
                     container="sfdscstatuslogs"
                     uploadDelayInSeconds="10">
        <Directory><![CDATA[Concat("", GetEnvironmentVariable("MONITORING_DSC_STATUS_LOGS"))]]></Directory>
     </FileWatchItem>
    </FileMonitors>
  </Events>
</MonitoringManagement>