To collect Windows events you need to create the Monitor Remote Windows Events data collector.
This data collector can collect Windows events both locally and remotely, but BMC recommends you to use it for remote collection.
Local collection implies collection of events by using the Collection Agent and from the computer where the Collection Agent resides, while remote collection implies collection of events by using the Collection Station and from the computer other than where the Collection Station resides. To collect Windows events locally, see Collecting Windows Events locally. For more information about local and remote collection, see Agent types.
The following information describes the process of creating this data collector:
Before you create the data collector for collecting Windows events, you need to perform certain configurations to enable the event collection. For more information, see Configurations required before collecting Windows events.
Provide the following information, as appropriate:
(Optional) Select from a list of hosts that you have already configured under Administration > Hosts.
The target host is the computer from which you want to retrieve the data. You can choose to select the target host and inherit the host-level tags and group access permissions already added to the host, or manually enter the host name in the Server Name field.
|Collection Host (Agent)|
Type or select the collection host depending on whether you want to use the Collection Station or the Collection Agent to perform data collection.
The collection host is the computer on which the Collection Station or the Collection Agent is located.
By default, the Collection Station is already selected. You can either retain the default selection or select the Collection Agent.Note: For this type of data collector, the target host and collection host are expected to have different values.
Enter the host name of the server from which you want to retrieve the data.
Note: If you selected a target host earlier, this field is automatically populated. The value of this field is necessary for generating the "HOST" field that enables effective data search.
(Optional) Select one of the following options:
Provide the user name for connecting with the server from which you want to retrieve the data.
Note: This field is disabled if you applied a security profile earlier.
Provide the password for connecting with the server from which you want to retrieve the data.
(Optional) Provide the domain of the Windows user with which you want to connect for retrieving the data files.
Click Test Connectionnext to the Domain field to verify that the credentials to the server are correct and are working.
Click Add CredentialAdministration > Credentials., provide a credential profile name, and click OK to create a new credential profile from the credentials that you provided in the user name, password, and domain fields. Once this credential profile is created, it is displayed under
|Windows Event Log(s)|
The product retrieves all the application logs configured on the collection host.
Enter the name of the log type that you want to collect and analyze; from the list of suggestions displayed select the correct log type. You can select multiple log types.
If your TrueSight IT Data Analytics installation is in a Linux environment, the following event logs are supported for Remote Windows Events:
|Read from Past (#days)|
Indicates the number of days for which the past data must be collected and indexed.
The maximum amount of past data that can be collected into the system is defined by the maximum data retention period set at Administration > System Settings.
By default, this value is set to 0. You cannot search data with a custom time that is set to a duration exceeding the value specified in this field.
BMC recommends you to not use a very high value in this field (for example, 365). This is necessary to avoid a very large amount of data collected into the system in a short time.
|Poll Interval (mins)|
Enter a number to specify the poll interval (in minutes) for the log collection.
By default, this value is set to 1.
|Start/Stop Collection||(Optional) Select this check box if you want to start the data collection immediately.|
|Ignore Data Matching Input|
(Optional) If you do not want to index certain lines in your data file, then you can ignore them by providing one of the following inputs:
Example: While using the following sample data, you can provide the following input to ignore particular lines.
|Data Retention Period (in days)|
Indicates the number of days for which indexed data must be retained in the system.
By default, this value is set to 7. The default value is based on the maximum data retention period specified at Administration > System Settings.
You can change this limit to a maximum of 14 days. To increase the limit beyond 14 days, you need to modify the value of the following property:
After changing the property value, you need to restart the Search component to apply the change.
For more information, see Understanding data retention and deletion.
|Inherit Host Level Tags From Target Host||(Optional) Select this check box to inherit your tag selections associated with the target host that you selected earlier. This option is not applicable if you did not select a target host. Note: After selecting this check box, you can further manually select additional user groups. When you manually select additional user groups, both the inherited permissions as well as the manually assigned permissions are applied. To remove the inherited permissions, clear this check box.|
|Select Tag name and corresponding value|
(Optional) Select a tag name and specify the corresponding value by which you want to categorize the data collected. Later while searching data, you can use these tags to narrow down your search results.
Example: If your are collecting data from hosts located at Houston, you can select a tag name for "Location" and in the value specify "Houston". While searching the data, you can use the tag, Location="Houston" to filter data and see results associated with the Houston location.
To be able to see tag names, you need to first add them by navigating to Administration > System Settings.To specify tag names and corresponding values, in the left box select a tag name and then type the corresponding tag value in the right box. While you type the value, you might see type-ahead suggestions based on values specified in the past. If you want to use one of the suggestions, click the suggestion. Click Add to add the tag name and corresponding value to the list of added tags that follow. Click Remove Tag to remove a tag.
The tags saved while creating the data collector are displayed on the Search tab, under the Filters panel, and in the Tags section.
Note: At a time, you can specify only one value for a tag name. To specify multiple values for the same tag name, each time you need to select the tag name, specify the corresponding value, and click Add.
For more information about tags, see Understanding tags.
|Inherit Host Level Access Groups From Target Host||(Optional) Select this check box to inherit your group access configurations associated with the target host that you selected earlier. This option is not applicable if you did not select a target host. |
Note: After selecting this check box, you can further manually select additional user groups. When you manually select additional user groups, both the inherited permissions as well as the manually assigned permissions are applied. To remove the inherited permissions, clear this check box.
|Select All Groups|
(Optional) Select this option if you want to select all user groups. You can also manually select multiple user groups.
Notes: You can access data retrieved by this data collector based on the following conditions.
For more information, see Managing user groups in IT Data Analytics.
Click Create to save your changes.