Windows Remote Monitoring (NT_REMOTE_CONTAINER)

Specify the event log name for which you want to create a filter.

Enter a unique name that represents the event filter, and follows these rules:

• The filter name cannot exceed 127 characters.
• The filter name cannot use the following format: user@domain.com. If this format is used for the filter name, the filter fails to filter events.

Select one of the following options, as appropriate:

• Report the number of events that match the filter criteria during each collection period - If you select this option, PATROL monitors the number of events that match the filter criteria during each collection cycle. Depending on which event types the filter monitors, the following parameters are used to report this data:
  • Number of Error Events (ELMError)
  • Number of Failure Audit Events (ELMFailureAudit)
  • Number of Information Events (ELMInformation)
  • Number of Other Type Events (ELMOtherTypes)
  • Number of Events (ELMStatus)
  • Number of Success Audit Events (ELMSuccessAudit)
  • Number of Warning Events (ELMWarning)
• Notify immediately when an event matches the filter criteria - If you select this option, PATROL immediately changes a parameter to an alarm state when an event matches the filter criteria.

  Depending on which event types the filter monitors, the following parameters are displayed in an alarm state when an event matches the filter:

  • Notifications of Error Events (ELMErrorNotification)
  • Notifications of Failure Audit Events (ELMFailureAuditNotification)
  • Notifications of Warning Events (ELMWarningNotification)
  • Notifications of Windows Events (ELMNotification)
    (This parameter is active only when you have selected both of the option, Notify immediately and consolidate event types.

Select this check box to disable case sensitivity for the source filtering.

You can specify whether to make filter comparisons in a case-independent manner for the source, user, category, and string options of a Windows event filter. To disable case-independent comparisons for any of the options, ensure that the corresponding Disable Case Sensitivity check box while configuring windows event monitoring is cleared.

The /PSX_P4WinSrvs/PWK_PKMforMSWinOS_config/EventLogMonitoring/eventlog/EventFilters/filter/FilterDisableCase configuration variable stores information about case-sensitivity of the event filter options.

This variable has five bit values, depending upon case sensitivity, one bit corresponding to each of Source, User, Category, String, and Computer name, respectively. If any bit value is 1, a case-independent filter comparison is made for the corresponding field.

You can set this variable to either of the following values:

• 00000 = none checked (default)
• 11111 = all 5 categories checked
• A combination of 0s and 1s, depending on which of the 5 categories were checked

To disable case-sensitivity in the event filters, set the value of the FilterDisableCase configuration variable to 00000.

Select one of the following options, as appropriate:

• Include all event sources in the list
• Exclude all event sources in the list

Select one or more of the following event types to use in the filter for monitoring.

• Critical
• Error
• Warning
• Information
• Verbose
• Success_Audit
• Failure_Audit
• Others

• Select this option if you want various types of events (for example, Warning, Information, Error) to be reported by using one parameter, ELMStatus (or ELMNotification if you configured to be notified immediately when an error occurs while defining the Report/Notify option).
• Clear this check box, if you want to have separate parameters for each event type that can raise alarms independently.

You can select one or more multiple IDs in the following ways:

• Single event ID. For example: 100
• Comma-separated list of multiple event IDs. For example: 100,110,120
• Range of event IDs. For example: 100-120
• Regular expression. For example: 1[0-5]3

Select one of the following options, as appropriate:

• Include all event IDs in the list
• Exclude all event IDs in the list

Specify the number of events that must be reported as a single event depending on the value that you specify in the Time within seconds field.

By default, this value is set to 1.

Specify the number of seconds that must be used for reporting multiple events as a single event.

By default, this value is set to 0.

Specify how you want to acknowledge the alarm raised by the event filter. You can specify one of the following values:

• automatic: If you specify automatic, then PATROL acknowledges alarms and returns the filter to an OK state if the filter criteria are not met during the most recent collection cycle. In other words, if the events you are monitoring do not occur during the collection cycle, the event filter state is changed back to OK. With this option you are not actively monitoring for alarms, you might not notice when the monitored events occurs because any alarms will be reset during the next collection cycle if the monitored events do not re-occur. Note: With this option, PATROL cannot acknowledge the alarm or return the filter to an OK state.
• filterName: If you specify the filter name, then PATROL changes the filter state from an alarm state to an OK state when the criteria of a second event filter are met. To use this option, you must create an event filter that monitors for the required event and that is configured to notify PATROL immediately when that filter criteria is met, and then specify the filter name in this field.

By default, this value is set to automatic.

Select one of the following options, as appropriate:

• Include all users in the list - Specifies that all of the users in the list are monitored by the event filter. Select this option when you only want to monitor specific users.
• Exclude all users in the list - Specifies that all the users except those in the list are monitored by the event filter. Select this option when you want to monitor all the users, except for a few specific users, which you want to exclude from the event filter.

Select one of the following options, as appropriate:

• Include all categories in the list - Specifies that all of the categories in the list are monitored by the event filter. Select this option when you only want to monitor specific categories.
• Exclude all categories in the list - Specifies that all the categories except those in the list are monitored by the event filter. Select this option when you want to monitor all the categories, except for a few specific categories, which you want to exclude from the event filter.

Specify the string associated with the events that you want to include for monitoring.

When entering a string that includes special characters that are used in regular expressions, such as a dollar sign ($), a period (.), a parenthesis (), or a slash (), you must escape each special character with a slash. For example, if the string is $Error, you must enter the string as \$Error.

Specify the string associated with the events that you want to exclude for monitoring.

When entering a string that includes special characters that are used in regular expressions, such as a dollar sign ($), a period (.), a parenthesis (), or a slash (), you must escape each special character with a slash. For example, if the string is $Error, you must enter the string as \$Error.

• Include all computers in the list - Specifies that all of the computers in the list are monitored by the event filter. Select this option when you only want to monitor computers.
• Exclude all computers in the list - Specifies that all the computers except those in the list are monitored by the event filter. Select this option when you want to monitor all the computers, except for a few specific computers, which you want to exclude from the event filter.