Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Active directory event logs

I have a request to Monitor Windows Active directory accounts for the event ID 644 (User account lockout) with the event text containing specific account details. With a bit of time and effort I can probably write the script to scan the event logs for this event. Is there a better way using APM, or does anybody have a script that already does something similar?

Find more posts tagged with

Accepted answers

josh.clark

There is a default template named "Windows Event Log Count". It uses a script that will search the event log for events that match a certain criteria. You should be able to specify an event id and search the event text.

Does that solve your problem?

All comments

FormerMember

A very popular way to do this is to use Orion's Windows Event Forwarder (which you can get for free from your customer portal). Install WEF on your DC. It will convert your events to Syslog, which you send send to Orion Syslog Server. You can create a rule to trigger an alert in Syslog when that event ID is encountered.

shanepj

I downloaded the Log Forwarder and I am going to start playing with it. Honestly though I am not sure I will be able to convince our Sys Admins to Install it on the our DC. Any other thoughts on how to do it if I cannot get them to install the Log Forwarder?

shanepj

After playing around with Log Forwarder for windows I am not sure it does what I need. The issue I am seeing is I cannot filter what events are being sent by using a search string in the event message text itself. This is an issue because ,While I could send all event's with an id of 644, I only want events with with specific text in the message of the event. Also Sending all of these events over to Orion and triggering an alert after processing this mass quantity of events does not seem overly efficient. Is this an issue only with the new version? I used the new version because the download site says "For users on Version 9, please use the new Log Forwarder for Windows instead of the Windows Event Forwarder. "

josh.clark

Does that solve your problem?