Windows Event Log Monitoring

Which is the better process to monitor Windows Event Logs? APM or Log Forwarder? I see APM being limited by the license issue where as Log Forwarder and Syslog is unlimited. Maybe the better question are the events that we should be alerted? If we are sending all the events to the syslog using Log Forwarder than which events should have email notifiations? I am looking for best practices to get started.

Find more posts tagged with

log_forwarder

windows_event_forwarder

windows_event_log_monitoring

Accepted answers

All comments

byrona

Well, I am not sure that there are any best practices for this, just what works best for you and your situation. I have APM unlimited licensing so that isn't a limiting factor for me; however, I still choose to use the Log Forwarder & Log Matching solution more often. I like the Log Forwarder because I can then show the last few logs for each node on the node details page to aid in troubleshooting.

If you use the Log Forwarding method you should read my comments on THIS POST for some best practices on setup/configuration.

Hope this helps!