EventLog Watch rules monitor your Windows servers/workstations using our Goliath Intelligent Agent to monitor your EventLog logs in real-time and alert on specified conditions.

Create a New Monitoring Rule

1. To create a new monitoring condition, navigate to the Management - Monitors page and click New.
2. For the Group dropdown, select a group in which to store the rule. This is for organizational purposes in the Monitors display.
3. In the Type dropdown, select Eventlog.
4. Name the Monitoring Rule via the Name field, as well as define the description and the severity.
5. In the Devices tab, select the devices to assign to the monitor.
   1. Please note, a machine can only be applied to one VMware ESX/ESXi Host monitoring rule type at a time.
6. The Options tab is where you will define condition(s) to be monitored.
   1. In the Log field, define the Event Log name that you would like to monitor. This field is required. If you select the “…” after the “log” field you can define a custom EventLog to monitor.
      1. A pop up will appear, enter the full name of the eventlog and then the full path the the evtx file
         1. see the eventlog properties for this information.
   2. In the Event ID field, you can optionally specify an Event ID to monitor. 
   3. In the Source field, you can optionally specify a log source to monitor.  
   4. In the Type field, you can optionally specify a log type to monitor. If there are other optional parameters defined, then an empty or blank Event Log Type is ignored. If there are NOT any other optional parameters defined, then the "empty" Type is interpreted to mean "all" types, and every event for the given Event Log will cause an alert. 
   5. In the User/Group field, you can optionally specify a username to monitor. You can specify more than one user or group my separating them with a comma. This field is not case sensitive. You can also enter an Active Directory Group Name so that any user that is a member of the Group would be considered a match. You can specify multiple Group Name parameters by separating with a comma. You can also mix User and Group names. Click the “…” button to the right of the field to access the Active Directory options. 
   6. In the Description field, you can optionally specify a description substring to monitor.  If separated by a comma, they are treated as a Boolean OR; if separated by a plus sign (+), they are treated as a Boolean AND.  You CANNOT mix substrings with a comma and a plus. 
   7. The AND Params check box will cause an Event Log alert if any of the parameter fields match (Boolean "Or" check) when the box is NOT checked.  When checked, it requires all the defined parameter fields to match (Boolean "And" check).
   8. The Exclude checkbox, when checked, EXCLUDES any Event matching the criteria defined by the various parameter fields above, and no alert condition occurs.
   9. The All Except checkbox, when checked, All Events Except those matching the criteria defined by the various parameter fields above, cause an alert condition to occur. 
   10. The Not RecvdIn __ Minutes checkbox, when checked, to generate an alert when any of the events matching the specified criteria do NOT occur within the minutes specified.  Any of the events that match criteria will reset the timer. 
   11. The Precedence field specifies how this rule is handled if the received Event Log event satisfies the criteria of multiple Monitoring Rules.  A higher-precedence (1 is higher than 2, etc.) trumps Monitoring Rules with a lower precedence. 
7. The Schedule tab of a monitoring rule allows users to define how frequently the rule will alert. This can be done by adjusting the following fields:

• Alert Every Time: Defines whether an alert is generated every time the conditions are on the previous tab are met.
  • When checked, an alert is generated every time the specified condition is met.
  • When unchecked, the alert is only generated if the alert conditions are met, and the Minimal Notification Interval, see below, is exceeded since the last alert for this type.
• Minimal Notification Interval: Defines the minimum amount of time that must elapse between events for the specified condition before another alert will be generated.
  • For example, if the interval is 15 minutes and the condition is being met every 3 mins, you will receive 1 alert every 15 minutes instead of being alerted at each occurrence.
    • However, each alert occurrence is considered unique based on the details. For example, an Event Log alert is considered the same based on being the same Event Type and ID, from the same server/workstation.
  • The Alert Every Time checkbox must be unchecked in order to use this option.
  • For ServerWatch IP Services, this also defines the minimum elapsed time since a service is first detected as down or failed before an alert is generated.
• When Any Single Event Occurs ____ Times In _____ Seconds
  • This field acts as an additional filter so that if an alert condition exists only after a specific event occurs the defined amount of times within the specified time frame.
  • Each event that matches the criteria is treated discretely when counting. For example, if you have a rule that is monitoring for multiple events, an event with ID 500 is counted separately from ID 501, even though both match the rule. 
  • If the ‘Combine All’ checkbox is checked, then matching events are not treated discretely and are combined together when counting. 
  • The ‘Include Description’ checkbox when checked causes the Event Description to be included as part of the set of parameters that are checked for a match on the same event; if unchecked the Event Description is not included in the check. 
  • When the Log Only When Criteria Met checkbox is checked the Event is written to the database, otherwise the Event is filtered and not written to the data
• Active Only if Server 'Owns".... This Cluster Group:
  • This option is for monitoring machines that are apart of a cluster. If the checkbox is checked, then the rule is monitoring and will alert only if the server is a member of a cluster, 'owns' the specified Cluster Group and the specified Cluster Group is 'Online'.

Additional Configuration

For additional configuration options please see the following articles:

• Enabling Notifications:
  • Configure Email and Text Alert Notifications
  • Configure SNMP Alert Notifications
  • Configure Syslog Alert Notifications
• Configure Custom Remediation