Show/Hide Toolbars

MonitorWare Agent

Navigation: Configuring MonitorWare Agent > Services

Event Log Monitor V2

Scroll Prev Top Next More

This dialog configures the Windows Event Log Monitor V2 service for Windows Vista, Windows 2008, Windows 7, Windows 8, Windows 2012 and Windows 10. For Windows 2000, 2003 and XP use the classical event log monitor.

 

Event Log Monitor

Event Log Monitor V2

Windows 2000

Windows Vista

Windows XP

Windows 2008

Windows 2003

Windows 7


Windows 8


Windows 2012


Windows 10


Windows 2016

 

 

The V2 event log monitor provides the ability to monitor so-called "log channels". Each channel can work either in polling of subscription mode. In subscription mode, we are automatically notified by the operating system whenever a new event is logged. In traditional polling mode, we periodically check the channel. In both cases, it is possible for a user to re-set the channel reporting to an older event (parameter "Last Record").

 

Both of these functionalities are implemented by periodically iterating over the configured channels. The frequency is controlled by the "Sleep Time" parameter.

 

 

services_093

Event Log Monitor Properties

 

 

Overrun Prevention Delay

File Configuration fields:

nPreventOverrunDelay

Description:

This property allows configuring a delay after generating an event. The time is the delay in milliseconds.

 

If run at a value of zero, the event log monitor service generates events as fast as the machine permits. We have seen scenarios where routers and receivers are not able to keep up with this rate, resulting in packet loss. In addition, the CPU of the reporting machine is run at 100% - which is not a problem because the service runs at a low priority. However, with even a 1-millisecond delay, there is no noticeable CPU activity even when large bursts of events are forwarded. At one millisecond, the service can still generate 1000 events per second.

 

The default setting is an overrun protection of five millisecond, which allows roughly 200 events per second. This should be sufficient for even very busy servers.

 

Select Message Format

File Configuration fields:

nFormatType
 
0 = XML Format

1 = Predefined EventFormat

Description:

With this option you can choose whether the Events will be extracted in "Raw XML Format" or in the "Predefined Event Format".

 

The XML format is the exact representation of the XML Stream returned by the EventLog System.

Please note that it only contains EventLog data and not a formatted message.

 

The "Predefined Event Format" is what the Event in the event viewer looks like.

 

SyslogTag Value

File Configuration fields:

szSyslogTagValue

Description:

The SyslogTag Value determines the SyslogTag that is used when forwarding Events via syslog. This is useful, if you want to determine later, what kind of syslog message this is, perhaps because you log EventLogs and syslog into the same database.

 

Sleep Time

File Configuration fields:

nSleepTime

Description:

As said in the overview, this controls iteration over the configured channels. The value is specified in milliseconds.

 

For channels configured to use Polling Mode, the "Sleep Time" parameter specifies how often they are processed. Note that when multiple channels are set to polling mode, they are processed one after another. So there is a somewhat larger delay in processing than given by the "Sleep Time" parameter. The total frequency depends on how busy all polling channels are.

 

For channels configured to subscription mode, the "Sleep Time" interval will only influence how often a potential reset of "Last Record" is checked. Other than that, it has no effect on the event delivery rate.

 

We suggest a value of 60,000 milliseconds for the "Sleep Time". With that setting, the event log monitor checks for new events every 60 seconds. Larger periods can be specified for occasionally connected systems or if email delivery with few emails per day is intended.

 

Very security-aware environments might use a shorter interval. The event log monitor service is specifically designed to limit the burden on the monitored system. As such, resource usage is typically low, even with frequently run event log checks. However, we do NOT recommend running the event log monitor more often than once a second.

 

Note that it is almost always an error to use a "Sleep Time" value of 0. The main processing loop of the EventLog Monitor V2 would re-run without any delay and would cause a very high CPU usage, close to 100%. For these reasons, future versions of the product will no longer permit to use a "Sleep Time" of zero and automatically change it to one.

 

Wait time after action failure

File Configuration fields:

nSubscriptionSleepTime

Description:

Adds some extra wait time (Delay) if an action failed to process. Without the delay, the subscription would immediately process the last event again. In some cases a reasonable delay before a retry is needed.

 

Emulate %Param% properties from old EventLog Monitor

File Configuration fields:

nEmulateParameters

Description:

This option emulates the %Param% properties, which were often used in the old EventLog Monitor. The new EventLog implementation (e.g Windows 7, Windows Server 2008 Windows 8, Windows Server 2012) does not support them in the same way anymore. The Event Log Monitor V2 is still able to provide parameters in the "old style" format, what means that log analysis scripts can receive a consistent stream of data for both new style and old style Windows events.

 

Include optional Event Parameters as properties

File Configuration fields:

nIncludeEventParameters

Description:

If enabled, the < EventData> node from the raw XML stream (Eventlog entry) will be searched for variables. If variables with names are found, they will be set as Properties with their variable name automatically. If the variable does not have a name, it will be set to a common name like “Param1, Param2 …. ParamX”.

 

Convert to EventLog Monitor V1

File Configuration fields:

nConvertToEventLogMonitorV1

Description:

This option maps the EventID's from the Security EventLog back to V1 (Windows 2000/2003). The internal InforUnitID is also changed to V1. This option helps postprocessing EventLog V1 and V2 events equally.

 

Delay writing LastRecord

File Configuration fields:

nEnableLastRecordDelay

Description:

Enables the LastRecord writeback delay to the configured properties below.

 

Save after waittime

File Configuration fields:

nLastRecordDelayTime

Description:

Regardless of the amount of processed eventlog entries, the lastrecord value will delayed for this waittime period.

 

Save after amount of entries

File Configuration fields:

nLastRecordDelayCount

Description:

Regardless of the configured waittime period, the LastRecord will be written after the amount of processed eventlog entries that are specified here.

 

 

Event Channels Tab

 

services_094

 

The most important part of this dialog is the treeview of available Channels. It specifies which event logs are to be monitored. In the screenshot above, the monitor is set to all Channels that are currently available. There happen to be custom Channels, too, due to Applications creating them on their own. They will be added to the treeview automatically every time you re-open this configuration window.

 

Here you can adjust the syslog facility and the event log types. You are also able to overwrite all existing custom advanced channel configurations with your new ones.

 

Channels

Channels which are checked in the table will be processed. Channels which are unchecked are kept in the configuration, but are not processed.

 

Facility

File Configuration fields:

nFacility

Description:

The Syslog facility to map information units stemming from this log to. Most useful if the message is to forward to a Syslog daemon.

 

Last Record

File Configuration fields:

szXMLBookmark

Description:

Windows event log records are numbered serially, starting at one. The service records the last record processed. This textbox allows you to override this value. Use it with caution!

 

If you would like a complete dump of a specific Windows event log, reset the "Last Record" to zero. If you missed some events, simply reset it to some lower value than currently set. It is possible to set "Last Record" to a higher value. This suspends event reporting until that record has been created. We strongly discourage to use this feature unless definitely needed.

 

Processing Mode

File Configuration fields:

nApiReadMode
 

0 = Subscription Readmode (Realtime)

1 = Polling Readmode (Sleeptime)

Description:

There are two processing modes available, first the default processing mode is “EventLog Subscription” which processes Events in realtime. This means events are send to MonitorWare Agent by the OS as they happen, there is no delay at all. The other processing mode called “Eventlog Polling” and is similar to the method used in the old EventLog Monitor. The EventLog is checked and processed periodically controlled by the sleeptime. However using the polling method, you enable the “Read EventLog From File” option.

 

 

General Values (Common settings for most services)

 

Default Ruleset Name

File Configuration fields:

szRuleSetName

Description:

Name of the rule set to be used for this service. The Rule Set name must be a valid Rule Set.