Security Compliance

Monitor Non-working Windows Event logs in SEM

This article provides information on how to collect or monitor non-working windows event logs from windows services and applications in Security and Event log manager. It covers various operations logs for windows Services.

First published date

11/23/2020 12:02 PM

Last published date

11/23/2020 12:02 PM

Overview

You have SEM (Formerly Log and Event manager) and you like to monitor Specific Windows Services based event logs in SEM.
And you have the relevant connector for them in SEM Agent nodes created via HTML console> Nodes> Select Node > Manage Node Connector, but you are not able to see the event logs in SEM web console.

It covers operational / admin logs for Windows Services such as DHCP, DNS, Terminal Service Local / Remote Connection manager etc and their corresponding connectors.

Product section

Security Event Manager

Cause

NA

Resolution

Non-working logs are located in a nested directory. When you open the Event Viewer to locate the targeted log file, you must drill down through one or more directories to access the file.

For example, you want to create an Event Monitor log for the Microsoft-Windows-CoreApplication/Operational file in the Microsoft > Windows > Apps-API directory. This file is in a nested directory, as shown below.


To create a monitor for a non-working log, create a Registry key (for SEM we only need steps 1 - 12. (e) only.

Create a Registry key

Warning: SolarWinds strongly recommends that you back up your registry before making any edits to your system registry. You should only edit the registry if you are experienced and confident in doing so. Using a registry editor incorrectly can cause serious issues with your operating system, which could require you to reinstall your operating system to correct them. SolarWinds cannot guarantee resolutions to any damage resulting from making registry edits.

This procedure describes how to create a Registry key that provides a shortcut to a non-working log.

  1. Back up your system registry.
  2. Log in to the target machine.
  3. Open the Event Viewer.

  4. Locate the non-working event log you want to monitor.

    For example:

    Microsoft-Windows-CoreApplication/Operational

  5. Right-click the file and select Properties.

  6. In the General tab, copy the content from the Full Name and Log path fields to a text document.

    The file should be located at:

    C:\\Windows\System32\winevt\logs\Microsoft-Windows-CoreApplication%4Operational

  7. Close the Log Properties window.

  8. Open a Run box and execute:

    regedit.exe

  9. In the Registry Editor, locate the EventLog directory at the following path:

    HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > EventLog

  10. Right-click EventLog and select New > Key.

  11. Enter a name for the log file using the following syntax:

    <path_to_folder>/<log_file_name>

    For example:

    Microsoft-Windows-CoreApplication/Operational

    When you are finished, the new key displays in the EventLog directory.

  12. Modify the key to include the full name and log path you copied to a text document in step 6, and the path to the Windows Event Log API DLL file (wevtapi.dll).
    1. Locate and open the text document you saved from step 6.
    2. Right-click the new key and select New > String Value.
    3. Name the string value File.
    4. Right-click the new string value and select Modify.

    5. Copy the log path from the text file to the Value Data field, and then click OK.

      This file should be located in your Windows Server operating system at:

      C:\\Windows\System32\winevt\logs\Microsoft-Windows-CoreApplication%4Operational