Submit a ticketCall us

Don’t fall victim to a ransomware attack
Backups are helpful, but sometimes that’s not enough to protect your business against ransomware. At our live webcast we will discuss how to protect against ransomware attacks with SolarWinds® Patch Manager and how to leverage log data to detect ransomware. Register now for our live webcast.

Home > Success Center > Log & Event Manager (LEM) > Create Windows Error Events filter in LEM

Create Windows Error Events filter in LEM

Table of contents
Created by Ezgi Muderrisoglu, last modified by MindTouch on Jun 23, 2016

Views: 76 Votes: 0 Revisions: 4


This article provides steps on how to create Windows Error Events filter in LEM.

Note: Make sure you have already carried out checks that the devices in question are sending Windows error event logs, and that the correct connectors are in place.


LEM version 6.2         


  1. Go to the Monitor page where the filters are.
  2. Click the + sign and click New Filter from the small drop-down menu that appears. The template for the new filter appears.
  3. Fill out the filter name: Windows Error Events.
  4. Fill out the description: Filter for events from Windows Error Events logs. Go to the next stage which is the Conditions.
  5. Go to Event Groups and locate Any Alert. Other details appear after clicking Any Alert in the list.
  6. Select EventInfo and drag it over to the Conditions box. The Any Alert.EventInfo = * appears and you need to type in the word: Error. It should appear as: Any Alert.EventInfo=*Error*
  7. Click the small group icon to add another group condition to the condition box.
  8. Continue to drag the following Any Alerts to the new conditions box and type in the following string condition:
    1. ToolAlias = *NT*
    2. ToolAlias = *Vista*
    3. ToolAlias = *Windows*
  9. The end result should look as follows:
  10. Click Save. The new filter should then appear for the user on the list of filters on the left side of the Monitor page.



Last modified
19:57, 22 Jun 2016