Event Log Aggregator

[dcwhitworth]

Can anyone recommend some software to making viewing server event logs easier. We've got quite a lot of servers now and it's a drag to check all the logs. There are some applications out there that will read server logs remotely and give a neat overview/summary. Is anyone using any of these ? I'm prepared to spend a bit of money to make my life easier if required ! Thanks

[Michael]

You should be able to view them all from MMC, local or remote. I can't see any easier way to go about it.

[srochford]

The MMC method works fine for up to about 6 servers but once you've got more than that it's hard to see what's going on - it won't all fit on the screen.

 

SCOM is the tool to collect everything about everything but might be overkill (and not sure of the price!)

 

For a cheaper (ie free!) method you can use EventCombMT (download here Download details: Account Lockout and Management Tools) It's part of a pack designed to troubleshoot account lockouts and it allows you to search a range of servers for specific events (so it's handy if you want to check for a particular problem; less good if you just want to know "were there any errors")

 

Also free but needing more time is writing your own scripts. The best tool to use is logparser (also free) which can connect to a machine and query the event log based on parameters you give it. A trivial example:

LogParser -i:evt "select  recordnumber, computername,timegenerated, message, sourcename from \\maws414-01\system where eventtype=1"

this gets data from event logs (i:evt) and in this case reads the specified fields from the system log on machine maws414-01 with eventtype 1 (ie an error)

 

As it stands, it writes it to the screen which is not much use but it can also dump it to a CSV file or (better!) a SQL database.

 

If you can use Powershell then it becomes even easier:

$yesterday=(get-date) - (new-timespan -day 1)
get-winevent -computername maws414-01 -FilterHashTable @{logname='system';level=2;starttime=$yesterday}

 

This works out the time "yesterday" and then connects to the named computer. It retrieves data from the system log with "level" set to 2 (errors) which happened in the past 24 hours.

 

there are loads more examples of powershell to read the event log - Get-WinEvent

[Arthur]

I can't see any easier way to go about it.

Windows Event Forwarding? It's built into Windows.

 

http://blogs.technet.com/b/otto/archive/2008/07/08/quick-and-dirty-enterprise-eventing-for-windows.aspx

 

One of the least known yet most powerful management features to ship with Windows Vista and Windows Server 2008 is built-in Event Forwarding which enables large scale health and state monitoring of a Windows environment (assuming health and state can be determined from Windows Events - which they usually can). Not only is this feature built into the latest versions of Windows, but it's also available for down-level OSs like Windows XP SP2+ and Windows Server 2003 SP1+

[Michael]

Windows Event Forwarding? It's built into Windows.

 

True you could use that, I forgot about it as I don't use it. You'd have to manage a really large domain to make any use of it. For most schools I suspect using MMC will easily be good enough. From the top of my head I don't know any school who use 6 Windows DCs for example.

[dcwhitworth]

Thanks for the replies. I'll have a look at some of these options. We currently use MMC but we've got over 20 servers and issues on some of the minor servers can easily go unnoticed.