Frequently asked questions

EventLog Analyzer is a comprehensive log management solution that can be used by enterprises of all sizes across different industries. Below are the unique selling propositions of EventLog Analyzer:

• Single console for monitoring and securing your entire network
• Easy to deploy, manage, upgrade, and scale up
• Wide-range of out-of-the-box report and alert profiles
• In-depth auditing capabilities, augmented threat intelligence, and integrated compliance management
• Affordable pricing: you pay for only what you need by licensing and enabling components as per your requirements

With EventLog Analyzer, you can:

• Collect, analyze, search, correlate, and archive log data from over 700 log sources.
• Process log data up to 25,000 logs/second to detect threats in real time and mitigate them.
• Detect malicious traffic using augmented threat intelligence.
• Comply with various regulatory policies such as PCI DSS, HIPAA, SOX, the GDPR, and more, or customize compliance reports using templates to meet the demands of IT regulations.
• Audit applications and networks devices using predefined reports and alert profiles.

EventLog Analyzer's key features are:

• Advanced threat Intelligence
• Automated incident response workflows
• Comprehensive log monitoring
• Real-time event correlation
• End-to-end incident detection, management, and response
• Application and network device auditing
• Integrated IT compliance management
• Cross-platform auditing

You can buy EventLog Analyzer directly from the ManageEngine Online Store or from a reseller near your location.

EventLog Analyzer is licensed based on the number of log sources that are added for monitoring. Log sources include:

• Devices (Linux and Unix devices; AS400 systems; and network devices such as routers, switches, firewalls, and intrusion detection systems (IDSs) and intrusion prevention systems (IPSs).
• Applications (Oracle database, Microsoft SQL servers, IIS and Apache web servers, DHCP Windows and Linux servers, and print servers.
• Windows servers.

Yes, please fill out this form to get a personalized quote that best suits your requirements.

The Free edition of EventLog Analyzer is limited to handling event logs from a maximum of five log sources. On the other hand, the Standalone edition can handle event logs from up to 1,000 log sources and the Distributed edition can handle event logs from an unlimited number of log sources. The paid editions also offer additional features.

Yes, download the fully functional 30-day trial version here. When you install the trial version, the Premium edition is installed and will work for 30 days. After 30 days, it will automatically convert to the Free edition unless you purchase a license for the Premium edition.

If you're interested in exploring the solution more before making a purchase decision, fill out this form to extend your evaluator license.

The trial version is a fully functional version of the EventLog Analyzer Standalone edition. When the trial period expires, EventLog Analyzer automatically switches to the Free edition.

If you are interested in exploring the Free edition of our solution, click here.

Each edition monitors different numbers of log sources and offers different features. For a detailed comparison between the three editions, click here.

We recommend the Distributed edition if you are:

• A large enterprise operating across different geographical locations with hundreds of log sources like Windows devices; Linux and Unix servers; network devices like routers, switches, firewalls, and IDSs and IPSs; and applications such as IIS and Apache web servers, Oracle and Microsoft SQL Server databases, and print servers.
• A managed security service provider (MSSP) with a large customer base spread across geographical locations.

Yes, you can. Ensure that the existing EventLog Analyzer installation is version 6.0 or later. Download the EXE/BIN of the latest EventLog Analyzer version on another server and convert it to the admin server. The existing server with the Premium edition license of EventLog Analyzer can then be converted to a managed server.

Caution: If you convert the existing server with the Premium edition license to an admin server, you will lose all collected data.

To learn more, refer to this documentation.

The EventLog Analyzer Distributed edition license should be applied in the admin server. The purchased license covers the log sources in the registered managed servers. You can continue to add log sources across various managed servers as long as you don't exceed the maximum number of log sources allowed by your license. You can view the number of log sources assigned to each managed server in the Managed Server Settings page.

When you try to add more log sources beyond the limit specified in your license, a warning message will be displayed in the admin server. You can then:

• Purchase a license to manage the additional log sources.
• Check the number of log sources in each managed server and manually remove log sources from the managed servers to make the number of monitored log sources equal to the number in the purchased license.
• Remove a registered managed server from the admin server to make the number of monitored log sources equal to the number in the purchased license.

No, a license can only be applied to an admin server. The license is automatically dispersed to the managed servers from the admin server.

The managed or unmanaged status of devices in the managed server are synchronized with the admin server during the data collection cycle, which happens every five minutes. Try adding other devices and applications in the managed server after a few minutes.

Refer to this documentation to learn how to download, install, and run EventLog Analyzer in your system.

Yes, here is the list of prerequisites for running EventLog Analyzer in your system.

Take a look at the complete list of system requirements for installing and working with EventLog Analyzer (Distributed and Standalone editions).

No, you do not have to reinstall or shut down the server. You just have to upload the new license file.

Best practices for EventLog Analyzer can be found in this guide.

Yes, you can install EventLog Analyzer in a Linux machine. However, for builds earlier than 12120, as the WMI interface doesn't work in a Linux environment, you have to install an open-source log forwarder like SNARE to forward your Windows event logs to the Linux server. For more details, watch our video on forwarding event logs to EventLog Analyzer server through SNARE.

For builds 12120 and above, EventLog Analyzer has its own Windows agent that can forward logs from Windows to Linux.

Best practices for securing your installation can be found in this guide.

Yes, you can access EventLog Analyzer using a web browser from any location as long as you can connect to the server in which EventLog Analyzer is running.

Find the complete solution architecture here (Standalone and Distributed editions).

This depends only on the capacity of the server on which EventLog Analyzer is installed. The EventLog Analyzer license does not limit the number of users accessing the application simultaneously.

One admin server is designed to manage 50 managed servers.

EventLog Analyzer requires one of the following browsers and versions to be installed on the system with at least a 1024x768 display resolution:

• Microsoft Edge
• Firefox 4 and above
• Chrome 8 and above

EventLog Analyzer supports the following databases as its back-end database: Bundled with the product:

• PostgreSQL

External databases:

• Microsoft SQL Server 2012
• Microsoft SQL Server 2014
• Microsoft SQL Server 2016
• Microsoft SQL Server 2017
• Microsoft SQL Server 2019

EventLog Analyzer supports the following operating systems and versions (both 32-bit and 64-bit architectures):

• Windows 7 and above, and Windows 2008 Server and above
• Linux: Red Hat RHEL, Mandrake, Mandriva, SUSE, Fedora, CentOS, Ubuntu, Debian
• VMware environment

Steps to optimize EventLog Analyzer's performance can be found in this guide.

Steps to configure agents for log collection in EventLog Analyzer can be found in this guide.

Steps to ensure high availability in EventLog Analyzer can be found in this guide.

View the complete list of third-party applications used by EventLog Analyzer.

EventLog Analyzer supports a wide range of log sources out of the box. Additionally, logs from legacy systems and in-house applications can be parsed using the custom log parser. Below are the commonly added log sources to EventLog Analyzer:

• Core Windows infrastructure
• Linux and Unix systems
• Database platforms
• Network devices: firewalls, NGFWs, IDSs and IPSs, routers, switches
• Web servers
• Hypervisors
• Security solutions such as vulnerability scanners and threat solutions

Find the complete list of supported log sources here.

EventLog Analyzer supports two different modes of log collection. They are:

• Agentless log collection
• Agent-based log collection

You can choose the mode of log collection based on your IT infrastructure, policies, and requirements. You can contact our support team at eventlog-support@manageengine.com for better guidance on choosing the log collection mode suitable for your organization.

Learn more about the latest EventLog Analyzer features and upcoming releases.

Request and install the latest EventLog Analyzer service pack here.

No, if you are using the Distributed edition, please apply the service pack only on the admin server, which will automatically update all the reporting managed servers. Please do not update the managed servers manually. If any of the managed servers fail to auto-update, please contact us at support@eventloganalyzer.com.

No, updates for EventLog Analyzer are free as long as you have a valid paid edition (Premium or Distributed) license applied.

Yes, fill this form to schedule a personalized web demo with one of our product experts. If you would like to try your hands on the fully functional online demo, click here.

Yes, click here to explore the fully functional online demo of EventLog Analyzer.

Sign up and listen to our latest podcast series here.

Sign up and join our upcoming virtual seminars here.

If you need technical assistance, you can contact our support team by filling this form.

Yes, fill this form to make a suggestion for a new feature you would like to see in our future releases of EventLog Analyzer.

Yes, and it's absolutely free. To avail technical support, all you have to do is enter your contact details when prompted during installation. Alternatively, you can directly contact our support team at eventlog-support@manageengine.com.