What Event Log Information is Required?
The following information is required to configure Windows Event Logs monitoring:
- The Event Log Name
- The Provider Name
- The Event IDs if you want to filter the events
How to Get the Required Information?
To get the required information:
- Open the Event Viewer
- Browse to the Event log you wish to monitor
- Select an event to display its details (in our example, TaskScheduler > Operational)
- In the General tab, look for the Log Name and the Event ID (in our example, "Microsoft-Windows-TaskScheduler/Operational" and "102")
Monitoring Windows Event Logs - Obtaining the Log Name and Event ID
- Select the Details tab and look for the Provider Name (in our example: Microsoft-Windows-TaskScheduler)
Monitoring Windows Event Logs - Obtaining the Provider Name
You now have all the information required to configure the Event Logs Monitor.
Configuring the Event Logs Monitor
To configure the Event Logs Monitor:
- Create a monitoring policy:
- Log on to the TrueSight console.
- In the navigation pane, expand Configuration and select Infrastructure Policies.
- In the Infrastructure Policies page, ensure that the Monitoring tab is selected and click Create Policy.
- Specify the monitoring policy properties
- Select the PATROL Agent on which the policy will be applied.
Monitoring Windows Event Logs - Creating the Monitoring Policy
- Configure Monitoring Studio:
- Click the Monitoring tab.
- Click Add Monitoring Configuration.
- In the Add Monitoring Configuration panel, select Monitoring Studio from the Monitoring Solution menu
Monitoring Windows Event Logs - Adding Monitoring Configuration
- Configure the Event Logs Monitor:
- Click to add a Monitor Group
- Provide the Monitor Group information
- Scroll down to the Event Logs section and click
Monitoring Windows Event Logs - Configuring the Event Logs Monitor
- Enter the Event Log Name and the Provider Name you previously obtained through the Event Viewer
- (Optional) Enter the Event ID(s) to include or exclude from monitoring
Monitoring Windows Event Logs - Configuring the Event Log Information
- Scroll down to the Monitor Settings section and provide the Internal ID and Display Name
Monitoring Windows Event Logs - Providing the Monitor Settings
- Click OK twice
- Click Save.