Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Windows Event View Logs

Hello,

I've purchased SAM, NTA & NPM products. Can some please explain the stepts to have errors in windows event viewer sent to a report or displayed within the orion web console.

Ultimately i'd like to have a daily report produced that shows all errors on our windows servers that are in event viewer.

Do i need extra software than the products i've purchased?

Thankyou

Find more posts tagged with

npm12345

Accepted answers

Petr.Vilem

Unfortunately detail table containing event details (messages etc.) is not available in report writer. However as there is "Advanced SQL" type of report, we can do anything. Here is the query which will grab details of all error events for last 24 hours collected by all windows event log monitors:

SELECT n.Caption, n.NodeID, c.Name as ComponentName, c.ID as ComponentID, wed.LogFile, wed.TimeGeneratedUtc, wed.EventCode, wed.SourceName, wed.[Message] FROM APM_WindowsEvent_Detail wed INNER JOIN APM_Component c ON wed.ComponentID = c.ID INNER JOIN APM_Application a ON c.ApplicationID = a.ID INNER JOIN Nodes n ON a.NodeID = n.NodeID   WHERE wed.EventType = 1 AND wed.TimeGeneratedUtc > DATEADD(hour, -24, GETUTCDATE())

I have uploaded report based on this query as

You can use this report to view events in web console online and using "Orion Report Scheduler" you configure task which will email for example daily snapshots of this report.

All comments

cdljel

Hi,

I've managed to get my windows event log errors sent to me via email using the following variable ${WindowsEventMessages}.

Could someone please help me producing a report based on that variable?

I've look through the Report Writer but i can't find that variable to product a report.

Thankyou

Petr.Vilem

SELECT n.Caption, n.NodeID, c.Name as ComponentName, c.ID as ComponentID, wed.LogFile, wed.TimeGeneratedUtc, wed.EventCode, wed.SourceName, wed.[Message] FROM APM_WindowsEvent_Detail wed INNER JOIN APM_Component c ON wed.ComponentID = c.ID INNER JOIN APM_Application a ON c.ApplicationID = a.ID INNER JOIN Nodes n ON a.NodeID = n.NodeID   WHERE wed.EventType = 1 AND wed.TimeGeneratedUtc > DATEADD(hour, -24, GETUTCDATE())

I have uploaded report based on this query as

You can use this report to view events in web console online and using "Orion Report Scheduler" you configure task which will email for example daily snapshots of this report.

Petr.Vilem

Note 1: I forgot to highlight that you need to have configured some applications which will contain Windows Event Log monitors responsible for collecting events from monitored machines. Easiest way to do this is assign default template "Errors in Application Event Log" to nodes you want monitor. Note that this template is configured to collect events only from "Application" log.

Note 2: Proposed solution with custom SQL report created/imported in Orion Report Writer and using Orion Report Scheduler for sending emails is different approach than using ${WindowsEventMessages} macro which is intended for usage with Advanced Alert Manager.

cdljel

Works great, thanks Petr.

Also would you know how to get rid of duplict messages so they only show up once in the report?

Thanks again.

Petr.Vilem

It depends on what kind of duplicity you mean:

1) If you have multiple Windows Event Log monitors configured to capture same event from the same node then you can:

a) change this configuration in manner that each type event can be captured only by one monitor (recommended)

b) tight report only to specific monitor instance(s) e.g. add "AND c.Name = 'My specific monitor'" to WHERE condition of report query

c) make report query much more complex based on fact that a.NodeID + wed.LogFile + wed.RecordNumber should uniquely identify event captured by multiple monitors

2) You would like to see event which is still repeated with the same message (but in fact we are talking about multiple events as they differs by time) only once in your report, than you can try following modification of report query:

SELECT n.Caption, n.NodeID, c.Name as ComponentName, c.ID as ComponentID, wed.LogFile, MAX(wed.TimeGeneratedUtc) LastTimeGeneratedUtc, wed.EventCode, wed.SourceName, wed.[Message], COUNT(*) as EventCount    FROM APM_WindowsEvent_Detail wed      INNER JOIN APM_Component c ON wed.ComponentID = c.ID      INNER JOIN APM_Application a ON c.ApplicationID = a.ID      INNER JOIN Nodes n ON a.NodeID = n.NodeID  WHERE wed.EventType = 1 AND wed.TimeGeneratedUtc > DATEADD(hour, -24, GETUTCDATE())GROUP BY n.Caption, n.NodeID, c.Name, c.ID, wed.LogFile, wed.EventCode, wed.SourceName, wed.[Message]