Collecting Windows events

Windows event logs are records of events that have occurred on a computer running on the Windows operating system. These records contain information regarding actions that have taken place on the installed applications, the computer, and the operating system itself. Windows event logs include actions taken by the users and by the processes running on the computer. These logs provide crucial context that helps in faster resolution.

The following Windows event logs are available and BMC Helix Log Analytics enables you to collect all of them:

• System: Logs regarding incidents on Windows-specific computers, such as outdated hardware drivers.
• Application: Logs regarding the installation of new software or hardware or currently running software.
• Security: Logs regarding Windows operating system audit policies, login attempts, and resource access.

The following image shows how Windows event logs are collected:

The following video (2:14) provides you with an overview of monitoring Windows events in BMC Helix Log Analytics.

Watch the YouTube video about overview of monitoring Windows events in BMC Helix Log Analytics.

Before you begin

• Download and install a Windows connector. For more information, see Installing-and-managing-Windows-connector.
• Create a filtering rule. For more information, see Creating-a-filtering-rule.

To collect Windows events

1. Click the Collection menu and select Collection Policies.
2. On the Collection Policies page, click Create.
3. Enter the policy information:
   1. Enter a unique name and description for the policy.
   2. From the Collection Type list, select Windows Events.
4. Enter the following information about the connector:
   1. From the Connector Type list, select Windows Connector.

   2. In Connector Selection Criteria, create the connector selection criteria to identify connectors for collection.
      When you click in the box, you are prompted to make a selection. Each time you make a selection, you are progressively prompted to make another selection. 
      The selection criteria consist of an opening parenthesis, followed by the slot name, the operator, the slot value (which can be a string based on the type of slot selected), and the closing parenthesis. You can optionally select the logical operator AND or OR to add additional conditions. Specifying the opening and closing parentheses is optional.
      The connector fields available to create the selection criteria are status, name, version, host_name, ip, and tags. 

      Important

      The values that you enter for a field in the selection criteria are case-sensitive. For example, if the host name is WebServer.example.com, add the selection criteria as ( host_name Equals WebServer.example.com ). If you enter, ( host_name Equals webserver.example.com ), the connector is not selected. To add case-insensitive values, use the Equals ignore case operator.

5. Enter the following information about log collection:
   1. In the Configuration step, click Configure.
   2. In the Customize Logs Data panel, select the channel from where you want to collect events.
      If you select the Default option, Windows events are collected from the following channels:
      • Application
      • Security
      • Setup

      • System

        Important

        Do not create duplicate collection policies for the connectors with the same channel.

   3. In the Collection Interval field, enter how frequently (in seconds) you want to collect Windows events.
   4. Select the Collect Existing Events check box to collect the existing events.
6. In the Tags field, enter the tags to identify the policy with the collected logs.
   The values that you enter in this field are added to the bmc_tags field that is present in the collected logs. You can use the field or tags to search and analyze logs.
7. In Fields, enter the custom information that you want to add to collected logs in the form of key-value pairs.
   Use these fields to search and analyze the logs in Explorer. For example, Key: applicationContext; Value: Windows. Use applicationContext:Windows as a search string to search and analyze the collected logs.
8. From the Filtering Rule list, select the filtering rule that you have created.
   If you have not created a filtering rule, see Creating-a-filtering-rule for instructions.
9. From the User group list, select one or more user groups to assign to the collection policy. 
   Users associated with this user group can see the data collected by this collection policy.
10. Select the Enable Collection Policy check box.
11. Click Save.
    The created policy is shown on the Collection Policies page.
12. To edit, enable, disable, or delete a policy, use the Actions menu.

To verify Windows events collection

To verify whether the log collection has started, select Explorer > Discover. Use the key:value pair present in the events, tags, or time range to view the collected Windows events. For example, search the logs by using the tag that you added to the events.

To view the out-of-the-box Windows events dashboard in BMC Helix Dashboards

1. Click the Dashboards menu.
2. Select Manage Dashboards.
   The Log Analytics folder is displayed.
3. Click the Windows Events dashboard.

Learn more

Read the following blog to learn how Windows event logs help you improve business performance: Analyse Windows Event Logs to improve business performance.

Where to go from here

Configuring-logs

Deriving-insights-from-logs

Generating-alerts-from-logs