Submit a ticketCall us

Bridging the ITSM Divide
Integrated help desk and remote support software for faster resolution

Join us on Wednesday, November 29, 2017 at 11 a.m. CT, as we discuss the benefits of effectively integrating your help desk software with remote support solutions to help increase the efficiency of IT administration, improve communication, and decrease mean time to resolution (MTTR) for IT issues of all sizes. This directly impacts end-user satisfaction and your business’ bottom line. Register Now.

Home > Success Center > Archive > 2017October25 - LEM Deletes > View real-time data

View real-time data

Created by Caroline Juszczak, last modified by Kevin.Swinson on Oct 25, 2017

Views: 85 Votes: 0 Revisions: 4

You can view all events in real time as they occur in the Monitor view. All events are collected from agent devices running the LEM agent and non-agent devices communicating with your syslog server.

Log & Event Manager uses filters to display specific types of events. When you open the Monitor view, the All Events filter is the default view. To stop the incoming event stream, click Pause in the toolbar.

File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data11_615x126.png

View event details

If you see an event that requires your attention, click Pause in the All Events toolbar to freeze all incoming events. Click the event in the grid to display detail about the event in the Event Details pane.

File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data20_428x309.png

For additional information about the event, click File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data13_23x17.png to review the event description.

File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data21_433x93.png

If you decide that the event needs immediate attention, click File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data14_16x16.png to create a filter for this event (for example, MachineLogon). The All Events grid is replaced with a grid that displays all related events.

File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data22_439x100.png

The filter is automatically saved to the Overview menu in the Filters pane. Log & Event Monitor will continue collecting all MachineLogon events and increment the count value so you can monitor this event for further activity.

File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data23.png

When you complete your event research, click File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data15.png to return to the Event Details information or click File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data16.png to toggle between the previous and next event in the grid.

To resume viewing all incoming events, click All Events in the Filters pane and then click Resume in the All Events toolbar.

Create a filter

If you want to focus on a specific types of event, you can create a filter. Log & Event Manager includes several preconfigured filters that organize events into specific groups, which include:

  • Security
  • IT Operations
  • Change Management
  • Authentication
  • Endpoint Monitoring
  • Compliance

See the Log & Event Manger User Guide for filter descriptions included in each group.

  1. Click the Monitor view.
  2. Click File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/Button-Plus(Gray)_16x12.png in the Filters pane and select New Filter.

    File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data1.png

  3. Enter a name and description in the Filter Creation window.

    File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data2.png

  4. Select the number of events to display in the Monitor grid.

    File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data7.png

    The default value is 1000.

  5. Locate a preconfigured group that matches the events you want to filter.

    File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data3.png

  6. (Optional) Select a notification in the Notifications group that executes when a filter event is found.

    File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data5.png

  7. Drag and drop your selected event group filter into the Conditions box.

    The filter name displays in the box.

    File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data4.png

  8. (Optional). Drag and drop your selected Notification filter into the Notifications box.

    The filter name displays in the box.

    File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data6.png

  9. Click Save at the bottom of the window.

    Your filter is saved in the Filters Overview menu.

    File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data8.png

View filtered events

When you select a filter in the Filters Overview drop-down menu, all filtered events appear in the Monitor view. If you see an event that requires attention, click Pause and then click an event. The event details display in the Event Details pane where you can research the event and take the appropriate action based on your corporate IT policy.

File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data9_434x124.png

You can use most filter groups to create a visual representation of the filtered data using a widget included in the Monitor view. These widgets are designed to surface trends or anomalies that may otherwise go unnoticed. The widget can also be added to your Ops Center dashboard.

For example, in the Authentication group, selecting the FailedLogins filter displays all failed logins by user account using a bar graph.

File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data17_438x346.png

In the widget interface, you can click File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data18.png to create a new widget, click File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/Button-WidgetGear.png to edit the widget, or click File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0F0/010/lem_qsg_view_realtime_data19.png to configure the existing widget.

 
Last modified

Tags

Classifications

Public