- Related Products
- ADManager Plus
- ADAudit Plus
- ADSelfService Plus
- Exchange Reporter Plus
- AD360
- Log360
Click here to expand
The Free Edition of EventLog Analyzer is limited to handling event logs from a maximum of five devices, whereas the Professional Edition can handle event logs from an unlimited number of devices. There is no other difference between the two editions, with respect to features or functionality.
Yes, a 30-day free trial version can be downloaded here. At the end of 30 days it automatically becomes a Free Edition, unless a new license is applied.
The trial version is a fully functional version of EventLog Analyzer Premium Edition. When the trial period expires, EventLog Analyzer automatically reverts to the Free Edition.
No, you do not have to reinstall or shut down the server. You just need to enter the new license file in the Upgrade License box.
This depends on the platform on which EventLog Analyzer is installed. If installed on a Windows machine, EventLog Analyzer can collect event logs or syslogs from Windows and Unix devices, Cisco Switches and Routers, and other syslog devices . If installed on a Unix machine, EventLog Analyzer can collect syslogs only from Unix devices, Cisco Switches and Routers, and other syslog devices.
This depends only on the capacity of the server on which EventLog Analyzer is installed. The EventLog Analyzer license does not limit the number of users accessing the application at any time.
Yes. As long as the web browser can access the server on which EventLog Analyzer is running, you can work with EventLog Analyzer from any location.
You can buy EventLog Analyzer directly from the ManageEngine Online Store, or from a reseller near your location.
No. EventLog Analyzer cannot work if DCOM is disabled on remote systems. You need to have DCOM enabled in remote windows servers for the logs to get collected and shown in EventLog Analyzer.
To monitor Windows Events in ELA Linux installation, you need to convert Windows Event messages into Syslog messages. To convert the message you have to use a separate tool.
Most features from windows and linux are identical. Tight integration for windows machines are not available in linux builds, Although there are manual steps available to achieve the missing windows functionality.
| # | Feature | UI | Windows Instance | Linux Instance | How to achieve the missing functionality? |
| 1 | Domain and workgroup discovery | ELA UI → Settings → Domains and Workgroup | Available | N/A | N/A |
| 2 | Device discovery | ELA UI → Settings → Devices → Windows Devices → Add Device(s) | Available | N/A | Manually enter device name and associate them with Agents. |
| 3 | Windows devices & Windows Application log collection | ELA UI → Settings → Devices → Windows Devices → Add Device(s) | Agentless, agent-based and snare supported. | Only agent-based and snare supported. | Download and install the agents manually or deploy using GPO/Endpoint Management Tool |
| 4 | Auto Push Windows agent | ELA UI → Settings→ Agents → Windows → Install Agent | Available | Not Available | Agents cannot be deployed to windows machines from Linux instances. Download and install the agents manually or deploy using GPO/Endpoint Management Tool |
| 5 | IIS Sites Discovery | ELA UI → Settings → Applications → IIS Servers | Available | N/A | We can collect IIS logs by selecting the device and browse the path manually through "Import Logs" feature |
| 6 | SQL Server as back-end database | Available | N/A | N/A | |
| 7 | MSSQL Discovery | ELA UI → Settings → Database Audit → Mssql Servers | Available | Not Available. | We can collect logs from MSSQL in Windows environments by manually entering the device details in the UI. |
| 8 | Mysql Discovery | ELA UI → Settings → Database Audit → MySql Servers | Available for Servers in Linux and Windows Environments | Available for Linux Environments only | We can collect logs from Mysql in Windows environments by manually entering the device details in the UI. |
| 9 | Workflow | ELA UI → Alerts → Workflow Audit → Create new workflow | All actions are available | Windows enviroment related actions are not available. Process Actions, Service Actions , Active Directory Actions and windows Actions are not available. | Not available |
| 10 | AD User Login | ELA UI → Settings → Technicians & Roles → Add Technician | Available | Not Available | Create and use in-built technicians or integrate with radius login. |
It is recommended that you install EventLog Analyzer on a machine with the following configuration:
Look up System Requirements to see the minimum configuration required to install and run EventLog Analyzer.
EventLog Analyzer can be started as a root user, but all file permissions will be changed, and later you cannot start the server as another user.
The web server port you have selected during installation is possibly being used by another application. Configure that application to use another port, or change the EventLog Analyzer web server port.
The archiving feature in EventLog Analyzer automatically stores all logs received in zipped flat files. You can configure archiving settings to suit the needs of your enterprise. Apart from that, if you need to backup the database, which contains processed data from event logs, you can run the database backup utility, BackupDB.bat/.sh present in the <EventLog Analyzer Home>/troubleshooting directory.
PostgreSQL database - For Build 8010 onwards
To take a backup of the existing EventLog Analyzer PostgreSQL database, ensure that the EventLog Analyzer server or service is stopped and create a ZIP file of the contents of <EventLog Analyzer Home>/pgsql directory and save it.
MSSQL database
Steps to take backup of MSSQL database:
Find the current location of the data file and log file for the database eventlog by using the following commands:
use eventlog
go
sp_helpfile
go
Detach the database by using the following commands:
use master
go
sp_detach_db 'eventlog'
go
Backup the data file and log file from the current location (<MSSQL Home>dataeventlog.mdf and <MSSQL Home>dataattention-grabbing) by zipping and saving the files.
MySQL database - For Build 8000 or earlier
To take a backup of the existing EventLog Analyzer MySQL database, ensure that the EventLog Analyzer server or service is stopped and create a ZIP file of the contents of <EventLog Analyzer Home>/mysql directory and save it.
How to configure EventLog Analyzer as service in Windows, after installation?
Normally, EventLog Analyzer is installed as a service.
Normally, the EventLog Analyzer is installed as a service. If you have installed it as an application and not as a service, you can configure it as a service any time later. The procedure to configure as service, start and stop the service is given below.
To configure EventLog Analyzer as a service after installation:
service. bat -i
How to configure EventLog Analyzer as service in Linux, after installation?
Normally, the EventLog Analyzer is installed as a service. If you have installed as an application and not as a service, you can configure it as a service any time later. The procedure to configure as service, start and stop the service is given below.
To configure EventLog Analyzer as a service after installation:
sh configureAsService.sh -i
Usage of EventLog Analyzer service command
<EventLog Analyzer Home>/bin # /etc/init.d/eventloganalyzer
Usage: /etc/init.d/eventloganalyzer { console | start | stop | restart | status | dump }
For Windows devices, enter the device name and the authentication details, and then add the device. For Unix devices, enter the device name and the port number of the syslog service, and then add the device. (Ensure that the syslog service is running, and that it is using the same port number specified here.)
The session information for each user can be accessed from the User Management link. Click the View link under Login Details against each user to view the active session information and session history for that user.
Please follow the below steps to move an existing EventLog Analyzer server to a new machine/server.
PostgreSQL database - For Build 8010 onwards
Stop the existing EventLog Analyzer server/service
Ensure that the process 'java.exe', 'postgres.exe' and 'SysEvtCol.exe' are not running/present in the task manager, kill these processes manually if some of them are still running
As a precautionary measure, copy the following complete folders (including the files and sub-folders) to another drive or to a mapped network drive. This will help us to restore to the settings and data in-case of any issue with the new machine installation.
The folder, pgsql located under <EventLog Analyzer Home> directory
The folder, Archive located under <EventLog Analyzer Home>archive directory
The folder, Indexes located uncer <Eventlog Analyzer Home>server/default directory
Please download and install in the new machine/server the latest build of Eventlog Analyzer from the following link: https://www.manageengine.com/products/eventlog/download.html
Do not start the newly installed EventLog Analyzer server/service.
In the newly installed EventLog Analyzer machine/server, rename the folder pgsql located under <EventLog Analyzer Home> as old_pgsql.
Copy the pgsql folder (including the files and sub-folders), which is located under <EventLog Analyzer Home> , from the old machine/server to the newly installed Eventlog Analyzer machine/server.
Note: Kindly take extra care that the EventLog Analyzer is not running on both the systems while performing this operation.
Start the EventLog Analyzer on the new machine and check whether the data and configurations are intact.
MSSQL database
Stop Eventlog Analyzer server/service.
Download and install the latest build of Eventlog Analyzer in the new server using the following link: https://www.manageengine.com/products/eventlog/download.html
Once you install the application in the new machine, kindly make sure that you do not start the application or shutdown the Eventlog Analyzer if started.
Please configure the MSSQL server credentials of the earlier Eventlog Analyzer server installation as explained in the Configuring MSSQL Database topic.
Start the Eventlog Analyzer server/service on the new machine and check whether the data and the configurations are intact.
In-case of any issues while performing the above steps, please do not continue any further and contact eventlog-support@manageengine.com to assist you better.
MySQL database - For Build 8000 or earlier
Stop the existing EventLog Analyzer server/service
Ensure that the process 'java.exe', 'mysqld-nt.exe' and 'SysEvtCol.exe' are not running/present in the task manager, kill these processes manually if some of them are still running
As a precautionary measure, copy the following complete folders (including the files and sub-folders) to another drive or to a mapped network drive. This will help us to restore to the settings and data in-case of any issue with the new machine installation.
The folder, MySQL located under <EventLog Analyzer Home> directory
The folder, Archive located under <EventLog Analyzer Home>archive directory
The folder, Indexes located uncer <Eventlog Analyzer Home>server/default directory
if MySQL password is set in the old server
startDB.bat and configureODBC.vbs located under <Eventlog Analyzer Home>bin directory.
myodbc3.dll and myodbc3s.dll located under <Eventlog Analyzer Home>lib directory.
mysql-ds.xml located under <Eventlog Analyzer Home>server/default/deploy directory
Please download and install in the new machine/server the latest build of Eventlog Analyzer from the following link: https://www.manageengine.com/products/eventlog/download.html
Do not start the newly installed EventLog Analyzer server/service.
In the newly installed EventLog Analyzer machine/server, rename the folder MySQL located under <EventLog Analyzer Home> as OldMySQL.
Copy the MySQL folder (including the files and sub-folders), which is located under <EventLog Analyzer Home> , from the old machine/server to the newly installed Eventlog Analyzer machine/server.
Note: Kindly take extra care that the EventLog Analyzer is not running on both the systems while performing this operation.
Start the EventLog Analyzer on the new machine and check whether the data and configurations are intact.
The DB Storage Options box in the Settings tab lets you configure the number of days after which the database will be purged. The default value is set at 32 days. This means that after 32 days, only the top values in each report are stored in the database, and the rest are discarded.
Graphs are empty if no data is available. If you have started the server for the first time, wait for at least one minute for graphs to be populated.
Reports can be generated in HTML, CSV, and PDF formats. All reports are generally viewed as HTML in the web browser, and then exported to CSV or PDF format. However, reports that are scheduled to run automatically, or be emailed automatically, are generated only as PDF files.
Can't find an answer here? Check out the EventLog Analyzer user forum
Copyright © 2020, ZOHO Corp. All Rights Reserved.
Download PDF