Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Windows Event Log Monitor - Exclude On Event ID?

Hi, our server team is currently evaluating APM on top of our NPM installation. They're pretty taken with the system at the moment but want to be able to monitor windows event logs with the 'Windows Event Log Monitor' component and exclude events from being monitored based on their Event ID. (Current functionality only allows only inclusion based on Event ID).

I realise there is the event log forwarder tool that provides this functionality by prepending a minus sign to the event ID but they're not happy installing what amounts to client software for monitoring and having to do it through syslog.

Mods, if you're reading this and it isn't currently possible please consider this a formal feature request.

Find more posts tagged with

Accepted answers

All comments

MarieB

Hi Gary--

I've marked this for the product manager to see. Also, are you working with a sales engineer during your eval process? If so, you can ask them about it. If not, let me know and I'll ping them.

Thanks,

chris.lapoint

Hi, our server team is currently evaluating APM on top of our NPM installation. They're pretty taken with the system at the moment but want to be able to monitor windows event logs with the 'Windows Event Log Monitor' component and exclude events from being monitored based on their Event ID. (Current functionality only allows only inclusion based on Event ID).
I realise there is the event log forwarder tool that provides this functionality by prepending a minus sign to the event ID but they're not happy installing what amounts to client software for monitoring and having to do it through syslog.
Mods, if you're reading this and it isn't currently possible please consider this a formal feature request.

I think there might be some confusion as to how the Windows Event Log monitor works. It doesn't retrieve all messages from the remote Windows machines being monitored. It scans the logs remotely and then only alerts when it finds a match.

Let me know if this helps clarify. If not, as Marie mentioned, we'd be happy to get an SE on the phone with you to discuss in more detail. If it works out that the use-case makes sense as a feature request, we'd be happy to consider it.

Windows Event Log Monitor.PNG

GaryP

Cheers Chris, I realise the difference between the monitor and the log forwarder and it was our server guys who specifically requested the exclude functionality.

I'll ask them if they can write up a more specific case for me, hopefully it may make a little more sense then (to you and me both!).

FormerMember

You can do excludes.

From the Admin Guide http://www.solarwinds.com/NetPerfMon/SolarWinds/wwhelp/wwhimpl/js/html/wwhelp.htm

Exclude events

Select With Keywords Below to specify simple keywords or phrases as the match criteria. Select Matching Regular Expression Belowto specify regular expressions that match text that appears in the events. For information about the regular expressions syntax, see ".NET Framework Regular Expressions",

Is that not what you're looking for?

GaryP

Cheers, Denny, but the Exclude/Include on keywords functionality (I believe) only operates on the contents of the <EventData> part of the event. My server team have a specific requirement to filter on the <EventID Qualifiers="16384"> part of event (with reference to the XML layout of the event logs).

They got back to me with a more specific case so I'll let them speak for themselves (FYI, EventSentry is the other product they're currently trialling against APM):

"Ideally we don't want to have to configure the component(s) to look for one or more specific Event IDs. Rather, we want to be notified by all Event IDs except for those that we specify to be excluded. I realise that it can notify of all errors (by leaving the field blank?) but then we can't exclude. I think we need to have the background noise initially and then we can filter events out as and when. The bonus with EventSentry is that, out of the box it notifies of all critical errors (and/or warnings, and/or information if so desired), minus a set of common IDs that are not important (which are added as exclusions). In this case we'd just be adding the odd exception that is specific to our environment (like Agresso "errors" that mean nothing)."