This test reports the statistical information about the events generated by various applications and windows services and drivers in the target system.

This page depicts the default parameters that need to be configured for the EventLogTest.

• The TEST PERIOD list box helps the user to decide how often this test needs to be executed.

• In the EVENTHOST text box, specify the name of the host for which this test is to be configured.

• Enter the specific events to be monitored in the EVENTSRC text box. The name of the event source can be obtained from the Event Viewer window that appears on following the menu sequence: Start -> Programs -> Administrative Tools -> Event Viewer (If the Programs menu does not contain the Administrative Tools option, then check Start->Settings ->Control Panel for the same). The value that appears in the Source column of this window should be used to specify the EVENTSRC parameter.

  By default, “All” will be displayed against EVENTSRC indicating that all events will be monitored by default. While specifying multiple events, make sure that they are separated by commas (,).

• If specific events are to be excluded from monitoring, then specify the events to be excluded in the EXCLUDEDSRC text box, as a comma-separated list.

• The eG agent can either use WMI to extract event log statistics or directly parse the event logs using event log APIs. If the USEWMI flag is YES, then WMI is used. If not, the event log APIs are used. This option is provided because on some Windows NT/2000 systems (especially ones with service pack 3 or lower), the use of WMI access to event logs can cause the CPU usage of the WinMgmt process to shoot up. On such systems, set the USEWMI parameter value to NO. On the other hand, when monitoring systems that are operating on any other flavor of Windows (say, Windows 2003/XP/2008/7/Vista/12), the USEWMI flag should always be set to ‘Yes’.

• Typically, the eG manager generates email alerts only when the state of a specific measurement changes. A state change typically occurs only when the threshold of a measure is violated a configured number of times within a specified time window. While this ensured that the eG manager raised alarms only when the problem was severe enough, in some cases, it may cause one/more problems to go unnoticed, just because they did not result in a state change. For example, take the case of the EventLog test. When this test captures an error event for the very first time, the eG manager will send out a CRITICAL email alert with the details of the error event to configured recipients. Now, the next time the test runs, if a different error event is captured, the eG manager will keep the state of the measure as CRITICAL, but will not send out the details of this error event to the user; thus, the second issue will remain hidden from the user. To make sure that administrators do not miss/overlook critical issues, the eG Enterprise monitoring solution provides the stateless alerting capability. To enable this capability for this test, set the STATELESS ALERTS flag to Yes. This will ensure that email alerts are generated for this test, regardless of whether or not the state of the measures reported by this test changes.

• The DD FREQUENCY refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD FREQUENCY.

• Once the necessary value has been been provided, click on the UPDATE button to register the changes made.

When changing the configuration for specific servers, a "*" beside the text box corresponding to the parameter signifies that these values have to be manually configured by the user. The parameter values that require to be configured will typically be prefixed with a "$" or contain a series of "*". A value of "none" in the parameter value indicates that the corresponding parameter value can be changed if required.