SIEM, Vulnerability Scanning, Server Monitoring and Compliance Training for IT Professionals
Table of Contents

Event Log Summary Report

An Event Log Summary Report is defined as a report that displays a count of the top entries with a short description next each entry. This report is typically used by network administrators and compliance and audit professionals to view a summary of the top logged events on Windows Servers.

Event Log Summary Reports are an implementation of the standard Event Log Consolidation Report with options set to generate the summary of unique events. The combination of each Source and Event ID defines an Event as unique. In other words, within each Event Log, each Source must be unique, then, within each Source, each Event ID must be unique. The result is a composite key comprised of the Source and Event ID.

Account Lockout Report Tutorial on youtube

In this Topic

How to create an Event Log Report

The Sample Reports include an implementation of an Event Log Summary Report. To view the sample report:

The Logs Tab

  • Selecting the Logs Tab reveals the Application, Security and System log files are selected. For more information on the Logs Tab see Assign Event Logs.

The Columns Tab

  • Selecting the Columns Tab reveals the column definitions, sort rules and group by rules.
  • Notice, the first column in the list of columns is Count. This column displays the count of distinct entries.
  • To extract and display a summary of each Event, a custom column keyed DESCRIPTION has been added that is a string type, has a maximum length of 64 characters and is populated using a regular repression result. The expression simply returns the first line of the log entry, then, the maximum length is used to truncate the results to the first 64 characters. If you would like to display more characters, increase this value.
Event Log Summary Report, Column Definitions View
Event Log Summary Report, Column Definitions View
  • Next, the Sort by Controls define the sort order of the results. Since this is a summary report of unique Events defined as the combination of each Source and Event ID, the following three columns are defined:
ColumnsDescription
CountDisplays the count of unique entries and is sorted descending so the most common Event log entry is displayed on the top and the least common entry displayed at the bottom of the report.
EventDisplays the Event ID and is sorted ascending so the distinct counts that have the same number (e.g. 1 entry), are displayed in order of Event ID).
SourceDisplays the Event Source which is sorted ascending so entries with the same count and Event ID are then sorted by the Event Source.
Event Log Summary Report, Sort by View
Event Log Summary Report, Sort by View
  • Next, the Group by Controls define how we would like to group each result set of data. This report is designed to be run against multiple servers so it groups results by host, enabling you to view the top entries for each host in one report.
Event Log Summary Report, Group by View
Event Log Summary Report, Group by View
  • Lastly, at the very bottom we can see the Regular expression Controls. In certain scenarios, a regular expression may be detached from a column. This view displays all configured regular expressions. In this report's case, there is just the one DESCRIPTION regular expression defined.
Event Log Summary Report, Regular expressions View
Event Log Summary Report, Regular expressions View

The Options Tab

  • Selecting the Options Tab reveals the filters, select distinct count and query by rules.
  • Two filters have been automatically assigned:
FilterDescription
Audit EntriesTargets Success Audit and Failure Audit entries found mostly in Security Logs however these Event types can be seen in any log.
Event Log Warning +Targets Warning and Error Event types.
Event Log Summary Report, Filters View
Event Log Summary Report, Filters View
  • Next, the filter option is set to pass all entries that pass Any of the filters.
Note
Other options include, creating a single filter that targets Warning, Error, Success Audit and Failure Audit Events or creating a filter that targets Informational Events then set the filter option to None.
  • Next, the Select distinct count Controls define the composite database key. In this case we are defining a unique entry as the combination of the Event ID and Event Source, listed as EVENT and SOURCE.
Event Log Summary Report, Select distinct count View
Event Log Summary Report, Select distinct count View
  • Just below we have the option of displaying the latest or the oldest entry in the report. The report defaults to the latest so we see the most recent unique entry in the report.
  • Finally, we see the Query by Controls which for this report are left blank since the report is summarizing all Events.

Host Assignment

Use the Assignments View to assign individual hosts or host groups to the report. For more information see: Host Assignments.

Important
This report requires each assigned host be assigned an Event Log Consolidation Template.

Sample Report

  • Once saved, you can view the report directly within the Management Console by clicking the View Report button.
Event Log Summary Report View
Event Log Summary Report View
  • Once displayed, notice the report is actually showing the current day rather than the period configured in the report. When generic Event Log Consolidation Reports, such as this report, are displayed within the Management Console, they display in pages of days and always begin with today. This is done on purpose so large reports are viewed in pages, vastly minimizing memory and CPU requirements. If you want to view the last seven days in one page, click the Date Date Button Toolbar Button, set the date you would like to start looking inclusively backward from, then, set the Days per page to 7.
Log Viewer Days per page Paging Control
Log Viewer Days per page Paging Control

Related Topics

Event Log Consolidation Template

Event Log Report

Host Assignments

Reports