SIEM, Vulnerability Scanning, Server Monitoring and Compliance Training for IT Professionals
Table of Contents

Event Log Consolidation Template

Event Log consolidation is the process of downloading Event Log entries then saving them to the Log Database. The Log Databases are configured under the Explorer View's Data Providers tree node.

In this Topic

Tutorials

Event Log Management (Part 1: Consolidation)

Event Log Management (Part 1: Consolidation)

Sample Templates

Server Manager includes several different sample Templates to quickly configure Event Log Management out-of-the-box. The sample templates can be found in the Explorer View under the Templates | Sample Templates tree node.

FolderDescription
Log ConsolidationContains Agent-Based and Agentless log consolidation templates that filter out common wasteful Security Event Log Entries then save for 150 days.
NIST/JSIG / WindowsContains Agent-Based and Agentless log consolidation templates save all log entries for either 1 year or 5 years.

How to Use the Sample Templates

Assign the target sample Template to the Host or Host Group you want to manage. For more information see: Assigning Templates.

Create your own Template

  • From the Menu Bar select File | New. The Create New Object View displays.
  • From the Create New Object View, select Template | Log Management | Log Consolidation. The Template Properties view displays.
  • The Template Properties view contains 7 tabs.
Note
By default this template downloads entries every hour and evenly distributes each download over the hour among the assigned hosts. For example, if you assign 60 hosts to this template the software will download entries form a single and different server every minute. After 60 minutes the first server will be downloaded again.

The Options Tab

  • Optionally assign a Consolidation filter to dump entries you do not want saved to the Log Database. When assigned, only entries that pass the assigned consolidation filter are saved to the Log Database.
  • Use the Initial number of days to download to configure the initial download. Subsequent downloads always pull from the last saved entry forward.
Important
If you have a heavily loaded domain controller you may need to limit the initial download of the Security Event Log to one day then build the database from that point on, otherwise you may receive a Quota Violation. You also have the option of specifying 0 days. When set to 0, Server Manager downloads the last hour of entries which should resolve any Quote Violation errors.
  • Use the Download in batches of option to minimize WMI results sizes. This option is yet another attempt to work around Quota Violation errors.
Important
If you are unable to resolve Quota Violation errors using the hourly batch method increase the Windows host's WMI Quota. For more information see: WMI Properties.
  • Use the Clear the remote Event Log after each download to clear the actual Event Log from managed hosts once the download is complete.
  • When configuring a Microsoft Application Log, use the Enable WMI API checkbox to access the log using WMI rather than the .Net EventLogSession API.
Important
When this option is set, several required Windows Registry entries are added to the managed host prior to downloading. If this option is not set, each downloaded Event's message may not be properly display.
  • Use the Log Entry Retention Policy drop-down to select the retention policy. The retention policy is another template that defines the number of days to retain in the Primary and Archive Log Databases, for example, archive entries older than 30 days and retain entries for 150 days for a total of 180 days. Assign multiple retention policies to remove entries that match filter criteria defined in each retention policy. For more information see: Log Entry Retention Policy Template
Event Log Consolidation Options Tab
Event Log Consolidation Options Tab

Related Topics

Log Consolidation Templates

Log Entry Retention Policy Template

Data Providers

Agent Server

WMI Properties

Log Monitor