Monitoring Windows Event Logs - A Tutorial

Part II - Implementation

Welcome to Part II of Event Log Monitoring tutorial. At the end of this tutorial, you will be able to successfully implement Windows Event Log monitoring in your network. If you are a beginner, you might want to check out Part I covering the basics of Event Logs.

Centralized Event Logs Monitoring

Here is an outline of the topics covered in this tutorial:

• An overview
• How Event Log Monitoring works
• Top Event Logs to be monitored
• Mapping Event Logs variables to OpManager alerts
• Configuring Event Log Monitoring
• Other useful links

An Overview

The Event Logs record all the happenings on the device and bear clues to several security hacks and application performance issues. It is a tedious task for an administrator to manually check and track issues on each and every Windows device. Tracking specific events across all Windows devices with a unified console makes event management easy. A solution that is capable of monitoring event logs actually parses the Windows events and shows the processed events along with the other alerts triggered by the solution, providing the flexibility to the administrator to handle complete network fault management from one window.

OpManager is a network monitoring solution that monitors the performance of all the resources on your network and manages the network fault. Extending its network fault management capability, OpManager also monitors Windows and Unix logs. The following sections of the tutorial helps you configure monitoring of Windows Event logs using OpManager.

How Event Log Monitoring Works

1. The OpManager server acts like a centralized Syslog server that collects messages from different monitored devices. OpManager authenticates to the Windows devices on the network using WMI and gathers the specifed Event Log messages.
2. The Event Log messages are collected and parsed into OpManager events based on the processing criteria defined as part of the Event Log rules. The event log rules are customizable.
3. These events are then correlated as OpManager Alerts and are displayed in the OpManager Alarms GUI. The events are not displayed to avoid cluttering the view.
4. You can connect to the Web client or the Smartphone GUI to view the alarms.
5. To view only the alarms triggered by Windows Event logs, go to the Alarms tab and select the menu and select Event Log Alarms.

Top Event Logs to be monitored

Here's a list of recommended security event logs that need monitoring. Make sure you identify other security issues that are specific to your enterprise and log them for monitoring.

Besides the above security related events, enable and track logging for mission critical applications and system resources.

Mapping Event Logs variables to OpManager alerts

The Event Logs are filtered for parsing into OpManager alerts based on the Event Log properties listed below. The table shows a loose mapping of the event log properties and the corresponding alert properties for easy understanding:

Configuring Event Log Monitoring using OpManager

Prerequisites

• Before moving your servers to the production environment you should verify whether pre-determined values (size and overwriting options) for event logs well suits your environment. Change the values based on your enterprise's needs.
• OpManager authenticates to the remote Windows devices in your network using WMI to fetch the event logs. Make sure you have a list of the correct domain names, user names with administrative privilege, and the corresponding passwords to enable authentication.
• The windows devices on which you want the event logs monitored, must be discovered in OpManager.

Steps to configure monitoring

• Configuring WMI Credentials
• Monitoring Windows Events in a device
• Using the Quick Configuration Wizard
• Creating an Event Log Monitor
• Monitoring Custom Event Logs
• Viewing Event Log-based Alerts in OpManager

Configuring WMI Credentials

1. In the OpManager GUI, go to Settings --> Discovery --> Credentials.
2. Click Add Credentials and choose a classification.
3. Configure the credential name and description.
4. Configure the following parameters and click Add to add the credentials:
   • the Domain Name/ the user name
   • the password.
     Example:- TestDomain\TestUser.
     
     

Monitoring Windows Event Logs in a Device

OpManager has over 50 Event Log monitors out-of-the-box. To monitor Windows event logs, you need to associate the event log monitors to the devices. To do so, follow the steps given below:

1. Go to Device page --> Monitors --> Actions (Top right corner).

1. Select the event logs to be monitored in the device.
2. Change the Polling Interval if necessary. During each poll, the selected event logs are compared with the events logged in the device and for the matching events, alarms are generated.
3. Click Save to save the changes.

Using the Quick Configuration Wizard

Alternatively, you can associate an event log rule with many devices at a time using Quick Configuration wizard.

1. From the Settings tab, go to Configuration and select Quick Configuration Wizard.
2. Select the log file from the displayed list.
3. Choose any one rule from the list of rules shown.
4. From the list containing All Devices, select the devices on which you want to monitor the event logs from and move them to the Event Log Associated Devices on the right.
5. Click Save. The event log monitor is associated to the selected devices.

Creating a New Event Log Monitor

To create a new event log monitor, follow the steps given below:

1. Under the Settings tab, go to Monitoringand select Event Log Rules.
   
   In this page, you can see the rules supported by OpManager. They are categorized into Applications, Security, System, DNS Server, File Replication Service, and Directory Service. You can add the event logs that you want to monitor under any of these categories.

1. Click Add.
   
   Entries to all the fields except Rule Name are optional. Event ID is a required field to identify the event but can be left empty in few exceptional cases, such as you want to monitor all events that are of the Event Types, say, error or information. Here the filter will be based on the Event Type.
   • Select a Log File Name from the drop down box
   • Type a unique Rule Name.
   • Enter the Event ID to be monitored. This is the unique identifier for the event logs.
   • Enter the event Source. This is the name of the software that logs the event.
   • Enter the event Category. Each event source defines its own categories such as data write error, date read error and so on and will fall under one of these categories.
   • Type the User name to filter the event log based on the user who has logged on when the event occurred.
   • Choose the Event Types to filter the event logs based on its type. This will typically be one among Error, Warning, Information, Security audit success and Security audit failure.
   • An accurate Description Match text helps you to identify the New Rule much faster.
   • Decide when to generate an alarm by specifying the number of times the event should be raised within a specified time.
   • Choose a severity for the alarm generated in OpManager for this event.
2. Click Save to save the event log rule.
   
   
   

Monitoring Custom Event Logs

You can monitor event logs under a custom category too. Some application events can be logged in a new category other than the default System/Applications/Security categories, enabling easy administration. You can now configure rules in OpManager to parse the events in such custom categories and trigger corresponding alerts in OpManager.

Here are the steps:

1. Go to Settings --> Monitoring --> Event Log Rules --> Add Custom Event log (you will find this option on the top right corner on this screen).
2. Select a device from which you can query for the event categories and hit Query Device. The custom log categories in the selected device are listed.
3. Select the category of events that you want monitored across the Windows devices and click Add.
4. The new category is listed along with the other categories under Settings --> Event Log Rules.
5. Click Save.
   
   
   
6. After you add the custom event category, you will find the category listed under Settings --> Monitoring --> Event Log Rules. Go on to add new rules to parse the events falling under this category.
   
   
   
7. You can now associate the rules (default or custom event logs) to the required devices and monitor them. Go to the device snapshot page and select a device. Click on Monitors and choose Event Log Rules monitors to select and associate the log rules.

Viewing EventLog-based Alerts in OpManager

After you associate the Event Log Monitors to the devices, OpManager monitors for events of the criteria defined in the Event Log Rule. When there are events matching the criteria, OpManager processes the Event Logs into OpManager Alerts. You can view these alerts in OpManager GUI:

1. Hit the Alarms tab in OpManager GUI. You will find all the alarms listed.
2. Select the Event Log Alarms to view alerts with Event Logs as source.
   
   

Other useful links

• What is WMI

Previous: Part I