Collecting Windows events
Windows event logs are records of events that have occurred on a computer running on the Windows operating system. These records contain information regarding actions that have taken place on the installed applications, the computer, and the operating system itself. Windows event logs include actions taken by the users and by the processes running on the computer. These logs provide crucial context that helps in faster resolution.
The following Windows event logs are available and BMC Helix Log Analytics enables you to collect all of them:
- System: Logs regarding incidents on Windows-specific computers, such as outdated hardware drivers.
- Application: Logs regarding the installation of new software or hardware or currently running software.
- Security: Logs regarding Windows operating system audit policies, login attempts, and resource access.
The following image shows how Windows event logs are collected:
The following video (2:14) provides you with an overview of monitoring Windows events in BMC Helix Log Analytics.
To collect Windows events
Click the Collection menu and select Collection Policies.
- On the Collection Policies page, click Create.
- Enter the policy information:
- Enter a unique name and description for the policy.
- From the Collection Type list, select Windows Events.
- Enter the following information about the connector:
- From the Connector Type list, select Windows Connector.
In Connector Selection Criteria, create the connector selection criteria to identify connectors for collection.
When you click in the box, you are prompted to make a selection. Each time you make a selection, you are progressively prompted to make another selection.
The selection criteria consist of an opening parenthesis, followed by the slot name, the operator, the slot value (which can be a string based on the type of slot selected), and the closing parenthesis. You can optionally select the logical operator AND or OR to add additional conditions. Specifying the opening and closing parentheses is optional.
The connector fields available to create the selection criteria are status, name, version, host_name, ip, and tags.
The values that you enter for a field in the selection criteria are case-sensitive. For example, if the host name is WebServer.example.com, add the selection criteria as ( host_name Equals WebServer.example.com ). If you enter, ( host_name Equals webserver.example.com ), the connector is not selected. To add case-insensitive values, use the Equals ignore case operator.
- Enter the following information about log collection:
- In the Configuration step, click Configure.
In the Customize Logs Data panel, select the channel from where you want to collect events.
If you select the Default option, Windows events from all channels (Application, Security, Setup, and System) are collected.
In the Collection Interval field, enter how frequently (in seconds) you want to collect Windows events.
- Select the Collect Existing Events check box to collect the existing events.
- From the Filtering Rule list, select the filtering rule that you have created.
If you have not created a filtering rule, see Creating a filtering rule for instructions.
- Select the Enable Collection Policy check box.
- Click Save.
The created policy is shown on the Collection Policies page.
To edit, enable, disable, or delete a policy, use the Actions menu.
To verify Windows events collection
To verify whether the log collection has started, select Explorer > Discover. Use the key:value pair present in the events, tags, or time range to view the collected Windows events. For example, search the logs by using the tag that you added to the events.
To view the out-of-the-box Windows events dashboard in BMC Helix Dashboards
- Click the Dashboards menu.
- Select Manage Dashboards.
The Log Analytics folder is displayed.
- Click the Windows Events dashboard.
Read the following blog to learn how Windows event logs help you improve business performance: .