Serilog not getting application events, only coded logger events

Question

I set up my application to use Serilog as the logging mechanism. And I do in fact get log files and can view them on Seq. Initially I was getting the application events logged, but for some reason I am no longer getting them. See the images below.

In the first image I am getting application events. Later, when doing the same testing operations, I am NOT getting the application events any more, only the coded events in the files (i.e. _logger.LogWarning("Warning");)

I set up Serilog in Main method.

public static int Main(string[] args)
{
    var currentEnv = Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT");

    var configuration = new ConfigurationBuilder()
        .AddJsonFile("appsettings.json")
        .AddJsonFile($"appsettings.{currentEnv}.json", optional: true)
        .AddEnvironmentVariables()
        .Build();

    //Configure logger
    Log.Logger = new LoggerConfiguration()
        .ReadFrom.Configuration(configuration)
        .CreateLogger();

    Log.Information("Logger created");

    try
    {
        Log.Information("Starting web host");
        BuildWebHost(args).Run();
        return 0;
    }
    catch (Exception ex)
    {
        Log.Fatal(ex, "Web Host terminated unexpectedly");
        return 1;
    }
    finally
    {
        Log.CloseAndFlush();
    }
}

    public static IWebHost BuildWebHost(string[] args) =>
        WebHost.CreateDefaultBuilder(args)
            .UseStartup<Startup>()
            .Build();
}

My Serilog settings

 "Serilog": {
  "Using": [
    "Serilog.Sinks.RollingFile",
    "Serilog.Sinks.Async",
    "Serilog.Sinks.ApplicationInsights",
    "Serilog.Sinks.Console",
    "Serilog.Sinks.Seq"
  ],
  "MinimumLevel": {
    "Default": "Information",
    "Override": {
      "Microsoft": "Warning"
    }
  },
  "WriteTo": [
    {
      "Name": "Async",
      "Args": {
        "configure": [
          {
            "Name": "RollingFile",
            "Args": { "pathFormat": "C:/Logs/Serilog/log-{Date}.log" }
          },
          {
            "Name": "Seq",
            "Args": { "serverUrl": "http://localhost:5341" }
          }
        ]
      }
    }
  ],
  "Enrich": [ "FromLogContext", "WithMachineName", "WithThreadId" ],
  "Properties": {
    "Application": "WebTemplate"
  }
}

Before I move on to making Serilog more functional, I would like to sort out why I am not getting application events any longer.

Answer 1

I expect this is down to the following section in your Serilog settings:

"MinimumLevel": {
    "Default": "Information",
    "Override": {
        "Microsoft": "Warning"
    }
}

Nicholas Blumhardt's blog post goes into detail about how the Override setting works:

The effect of the configuration above, then, is to generate events only at or above the Warning level when the logger is owned by a type in a Microsoft.* namespace.

This quote seems to apply directly to your situation, whereby you are asking Serilog to filter out any events that belong to the Microsoft.* namespace and are lower than a severity of Warning.

The messages you show in your first screenshot are coming from either MVC or Entity Framework, which live in the Microsoft.* namespace and will be logging at a lower severity than warning.