I have received a number of questions lately regarding event collection. In this post I will show you how you can collect events and review them both in reports and in the console.<\/p>\n
Start by creating a new rule, authoring\/rules\/create a rule\/collection rule\/NT event log. The collection rule will only collect, not generate any alerts. In my example I use Windows Server 2008 Computer as target. I will create the rule disable as default. Then override and enable it for a group including a couple of windows server 2008 computer objects.
\nWhen you have created the new rule you can create a new event view in the monitoring workspace. Remember to create the new view in the same MP as the collection rule is stored.<\/p>\n
The next step is to create a report. You can use the generic Custom Event report to create a linked report showing all the events. Run the Custom Event report and select a couple of windows server 2008 computers as objects, filter the report for example in my example Event ID equals 666. Note that you have to check its checkbox for every report field you want to include. If you check any checkboxes you will get a empty report.<\/p>\n
If you don\u00e2\u20ac\u2122t like the default event report you can author a new in Visual Studio. You can read my guide about that here<\/a> and use the following query when building the data set in Visual Studio<\/p>\n SELECT To generate test events you can use eventcreate, which is built-in into Windows 2003 and 2008. For example run “Eventcreate \/L Application \/D \u00e2\u20ac\u0153test\u00e2\u20ac\u009d \/T ERROR \/ID 666” .To generate an event in the application log with event ID 666 and \u00e2\u20ac\u0153test\u00e2\u20ac\u009d as event description.<\/p>\n","protected":false},"excerpt":{"rendered":" I have received a number of questions lately regarding event collection. In this post I will show you how you can collect events and review them both in reports and in the console. Start by creating a new rule, authoring\/rules\/create a rule\/collection rule\/NT event log. The collection rule will only collect, not generate any alerts. … Continue reading
\nvEvent.DateTime,
\nvEventPublisher.EventPublisherName as ‘EventSource’,
\nvEventLoggingComputer.ComputerName as ‘Computer’,
\nvEventLevel.EventLevelTitle as ‘Type’,
\nvEvent.EventDisplayNumber as ‘EventID’,
\nvEventChannel.EventChannelTitle,
\nvEventUserName.UserName,
\nvEventDetail.RenderedDescription as ‘EventDescription’
\nFROM
\nEvent.vEvent LEFT OUTER JOIN
\nvEventUserName ON vEvent.UserNameRowId =
\nvEventUserName.EventUserNameRowId LEFT OUTER JOIN
\nvEventCategory ON vEvent.EventCategoryRowId =
\nvEventCategory.EventCategoryRowId LEFT OUTER JOIN
\nvEventPublisher ON vEvent.EventPublisherRowId =
\nvEventPublisher.EventPublisherRowId LEFT OUTER JOIN
\nvEventLoggingComputer ON vEvent.LoggingComputerRowId =
\nvEventLoggingComputer.EventLoggingComputerRowId LEFT OUTER JOIN
\nvEventLevel ON vEvent.EventLevelId = vEventLevel.EventLevelId LEFT OUTER JOIN
\nvEventChannel ON vEvent.EventChannelRowId =
\nvEventChannel.EventChannelRowId LEFT OUTER JOIN
\nEvent.vEventDetail ON vEvent.EventOriginId = vEventDetail.EventOriginId
\nWHERE vEventLevel.EventLevelTitle = ‘Error’
\nORDER BY vEvent.DateTime, vEventLoggingComputer.ComputerName<\/p><\/blockquote>\n