Network Management

How to Monitor a Custom Windows Event in OLM

This article explains on how to monitor a Custom Event under Applications and Service Logs in Orion Log Manager

First published date

11/10/2025 11:25 AM

Last published date

11/10/2025 11:25 AM

Overview

 

By design, the Orion Log Manager can monitor Windows Events pre-defined in the Whitelist Article.

In some cases, the customers needs to monitor Custom Events under Applications and Services Logs.

 

 

Initially, to configure a Windows Custom Events hosted under Applications and Services Logs, you need to edit it in AdvancedConfiguration page, find the LogManagement.WindowsEvent.Settings > Query

 

You will see the default Security Events.

<!--Warning: Content length of the Select element is limited to approximately 450 characters. 
Longer content might not be accepted as valid query. 
Always check first with Windows Event Viewer Custom view to validate it is ok.--><QueryList>  <Query Id="0">    
<Select Path="Application">*</Select>
    <Select Path="Security">*[System[Provider[@Name="Microsoft-Windows-Security-Auditing"] and (EventID=4608 or EventID=4609 or EventID=4616 or EventID=4624 or EventID=4625 or EventID=4634 or EventID=4688 or EventID=4689 or EventID=4698 or EventID=4699 or EventID=4700 or EventID=4701 or EventID=4702 or EventID=4704 or EventID=4705 or EventID=4715 or EventID=4719 or EventID=4720 or EventID=4722 or EventID=4723)]]</Select>    
    <Select Path="Security">*[System[Provider[@Name="Microsoft-Windows-Security-Auditing"] and (EventID=4724 or EventID=4725 or EventID=4726 or EventID=4727 or EventID=4728 or EventID=4729 or EventID=4730 or EventID=4731 or EventID=4732 or EventID=4733 or EventID=4734 or EventID=4735 or EventID=4737 or EventID=4738 or EventID=4739 or EventID=4740 or EventID=4741 or EventID=4742 or EventID=4743 or EventID=4744)]]</Select>    
    <Select Path="Security">*[System[Provider[@Name="Microsoft-Windows-Security-Auditing"] and (EventID=4745 or EventID=4746 or EventID=4747 or EventID=4748 or EventID=4749 or EventID=4750 or EventID=4751 or EventID=4752 or EventID=4753 or EventID=4754 or EventID=4755 or EventID=4756 or EventID=4757 or EventID=4758 or EventID=4759 or EventID=4760 or EventID=4761 or EventID=4762 or EventID=4763 or EventID=4764)]]</Select>    
    <Select Path="Security">*[System[Provider[@Name="Microsoft-Windows-Security-Auditing"] and (EventID=4767 or EventID=4781 or EventID=5025 or EventID=5030 )]]</Select>    <Select Path="Security">*[System[Provider[@Name="Eventlog"] and (EventID=1100 or EventID=1102 or EventID=1108)]]</Select>    
    <Select Path="System">*</Select>    
    <Select Path="ForwardedEvents">*</Select>  </Query></QueryList>

 

Product section

Orion Platform

Cause

 

To configure a Custom Windows Event under Applications and Services Logs, you need to include it in the Select Path.

E.g:

Let's suppose the customer wants to monitor the custom Event in Windows Remote Management.

The following Windows Remote Management > Operational log (Events 45 or 47 or 49)

You need to add the following line in the AdvancedConfiguration Setting and submit:

<Select Path="Microsoft-Windows-WinRM/Operational">*[System[Provider[@Name="Microsoft-Windows-WinRM"] and (EventID=49 or EventID=47 or EventID=45)]]</Select>

The Path can be checked using the following PowerShell command, to get the exact name of the Path.

#Get-WinEvent -List winrm

 

After enabling it, you can create a Windows rule pointing to the EventID you need to monitor, in this example, 49.

 

With this configuration, you will be able to see the Custom Windows Event in the Log Viewer.