Windows Event Log Monitoring Efficiency

Question

Building an application template that monitors 100 event sin various windows event logs. I have found it outs huge load on the system its monitoring. Tracing with ETW seems to indicates that SAM is scanning the event logs looking for matching events rather than using subscriptions to these events. Is this correct? if so this is horrible design for scalabilty

jvb · Accepted Answer

Are you using a single component for each Event ID?

If so you may want to look at using the Match only specific IDs option and provide a comma delimited list of IDs and reduce the number of components.

You could also look at reducing the "Number of past polling intervals to search for events" option as well.

That being said, you are correct about the collection method. The component is parsing the log to find the matches.

Often the event component is used in a more targeted approach to compliment performance data rather than wide ranges of events.

If you were looking for more of a mass ingestion type of event collection there are a couple of other potential options.

You could use the free Windows Event forwarder to send the logs over to the Syslog on Orion and handle the events there:
FREE Event Log Forwarder for Windows | SolarWinds

Or you could look at the Log and Event Manager which uses an agent to collect, encrypt and deliver the logs to a virtual appliance for processing:

Log & Event Manager - Log Management Software | SolarWinds

Looking a little further forward, our new Log Manager for Orion will have an option to ingest events from Windows nodes:

What We’re Working on for Log Manager (Updated June 4th 2018)

Log Manager for Orion - Manage Centralized Event Logs | SolarWinds