PRTG 9 Manual: Event Log (Windows API) Sensor

Windows API Event Log specific

Log file

Specify the log file the sensor will monitor. The Windows event log provides several different log files. A drop down list specific to your system is shown. Please select a log file from the list. Choose between:

• Application
• System
• Security
• Directory Service
• DNS Server
• File Replication Service

Basic Sensor Settings

Sensor Name

Enter a meaningful name to identify the sensor. The name will be shown by default in the device tree and in all alarms.

Tags

Enter one or more tags, separated by space or comma. You can use tags to group sensors and use tag-filtered views later on. Tags are not case sensitive. We recommend using the default value. You can add additional tags to it, if you like. Other tags are automatically inherited from objects further up in the device tree. Those are not visible here.

Priority

Select a priority for the sensor. This setting determines where the sensor will be placed in sensor lists. Top priority will be at the top of a list. You can choose from one star (low priority) to five stars (top priority).

Filter Event Log Entries

Filter by Source

Filter all received events for a certain event source. If enabled, only messages matching the defined value will be considered by the sensor. Choose between:

• Off: Do not filter by event source.
• On: Enable filtering by event source.

Match String (Event Source)

This field is only visible if filtering is enabled above. Enter a source from which the events are to come from. Only events from a source matching this string will be regarded, others ignored. You can also use the percent sign (%) as placeholder for any or no character (as known from the asterisk sign (*) in Windows search) in combination with a substring. For example, you can enter %RAS% for any event source containing the string RAS. Please enter a string.

Filter by ID

Filter all received events for a certain event ID. If enabled, only messages matching the defined value(s) will be considered by the sensor. Choose between:

• Off: Do not filter by event ID.
• On: Enable filtering by event ID.

Match Value (Event ID)

This field is only visible if filtering is enabled above. Enter one or more event IDs (comma separated) from which the events are to come from. Only events with an ID matching one of the values will be regarded. Please enter one integer value or more comma separated integer values.

Filter by Category

Filter all received events for a certain event category. If enabled, only messages matching the defined value will be considered by the sensor. Choose between:

• Off: Do not filter by event category.
• On: Enable filtering by event category.

Match String (Event Category)

This field is only visible if filtering is enabled above. Enter a category which the events are to have. Only events with a category matching this string will be regarded. You can also use the percent sign (%) as placeholder for any or no character (as known from the asterisk sign (*) in Windows search) in combination with a substring. For example, you can enter %N% for any event category containing the character N. Please enter a string.

Filter by Event User

Filter all received events for a certain event user. If enabled, only messages matching the defined value will be considered by the sensor. Choose between:

• Off: Do not filter by event user.
• On: Enable filtering by event user.

Match String (Event User)

This field is only visible if filtering is enabled above. Enter a user name which the event are to be assigned to. Only events with a user name matching this string will be regarded. You can also use the percent sign (%) as placeholder for any or no character (as known from the asterisk sign (*) in Windows search) in combination with a substring. For example, you can enter A% for any user name starting with the character A. Please enter a string.

Filter by Event Computer

Filter all received events for a certain event computer. If enabled, only messages matching the defined value will be considered by the sensor. Choose between:

• Off: Do not filter by event computer.
• On: Enable filtering by event computer.

Match String (Event Computer)

This field is only visible if filtering is enabled above. Enter a computer name which the events are to be assigned to. Only events with a computer name matching this string will be regarded. You can also use the percent sign (%) as placeholder for any or no character (as known from the asterisk sign (*) in Windows search) in combination with a substring. Please enter a string.

Filter by Event Message

Filter all received events for a certain event message. If enabled, only messages matching the defined value will be considered by the sensor. Choose between:

• Off: Do not filter by event message.
• On: Enable filtering by event message.

Match String (Event Message)

This field is only visible if filtering is enabled above. Enter a message which the event must contain. Only events with a message matching this string will be regarded. You can use the percent sign (%) as placeholder for any or no character (as known from the asterisk sign (*) in Windows search) in combination with a substring here. Please enter a string.

Sensor Display

Primary Channel

Select a channel from the list to define it as the primary channel. In the device tree, the last value of the primary channel will always be displayed underneath the sensor's name. The available options depend on what channels are available for this sensor.

Chart Type

Define how different channels will be shown for this sensor.

• Show channels independently (default): Show an own graph for each channel.

• Stack channels on top of each other: Stack channels on top of each other to create a multi-channel graph. This will generate an easy-to-read graph which visualizes the different components of your total traffic. Note: This option cannot be used in combination with manual Vertical Axis Scaling (available in the Sensor Channels Settings settings).

Stack Unit

This setting is only available if stacked graphs are selected above. Choose a unit from the list. All channels with this unit will be stacked on top of each other. By default, you cannot exclude single channels from stacking, if they use the selected unit. However, there is an advanced procedure to do so.

Scanning Interval

Scanning Interval

The scanning interval determines the time the sensor waits between two scans. Select a scanning interval (seconds, minutes, or hours) from the list. You can change the available intervals in the system administration.

Schedules and Dependencies

Schedule

Select a schedule from the list. Schedules can be used to pause monitoring for a certain time span (days, hours) throughout the week. You can create new schedules and edit existing ones in the account settings. Note: Schedules are generally inherited. New schedules will be added to existing ones, so all schedules are active.

Dependency Type

Define a dependency type. Dependencies can be used to pause monitoring for an object depending on the status of another. You can choose between:

• Use parent: Pause the current sensor if the device it is created on is in a Down status, or if it is paused by another dependency.
• Select object: Pause the current sensor if the device it is created on is in an Down status, or if it is paused by another dependency. Additionally, pause the current sensor if a specific other object in the device tree is in a Down status, or if it is paused by another dependency. Select below.
• Master object for parent: Make this sensor the master object for its parent device. The sensor will influence the behavior of the device it is created on: If the sensor is in a Down status, the device will be paused. For example, it is a good idea to make a Ping sensor the master object for its parent device to pause monitoring for all other sensors on the device in case the device cannot even be pinged. Additionally, the sensor will be paused if the parent group of its parent device is in a Down status, or if it is paused by another dependency.

Note: Testing your dependencies is easy! Simply choose Simulate Error Status from the context menu of an object that other objects depend on. A few seconds later all dependent objects should be paused.

Dependency

This field is only visible if the select object option is enabled above. Click on the reading-glass symbol and use the object selector to choose an object on which the current sensor will be dependent on.

Inherit Access Rights

User Group Access

Define which user group(s) will have access to the object you're editing. A table with user groups and right is shown; it contains all user groups from your setup. For each user group you can choose from the following access rights:

• Inherited: Use the settings of the parent object.
• None: Users in this group cannot see or edit the object. The object does not show up in lists and in the device tree. Exception: If a child object is visible to the user, the object is visible in the device tree, though not accessible.
• Read: Users in this group can see the object and review its monitoring results.
• Write: Users in this group can see the object, review its monitoring results, and edit the object's settings. They cannot edit access rights settings.
• Full: Users in this group can see the object, review its monitoring results, edit the object's settings, and edit access rights settings.

You can create new user groups in the System Administration—User Groups settings. To automatically set all objects further down in the hierarchy to inherit this object's access rights, set a check mark for the Revert children's access rights to inherited option.