Cheshire Cat Computing

Hello Steve
I do have to commend you on the outstanding product to monitor the event logs. I do have a question. I monitor a lot of server here onsite and what I would like to know if there is an easier way of doing the filtering. I ask because most of the time, there are Event Log Errors that are just garbage. For example: Terminal Server Printers, WinMgt, etc…. I want to know if there is an easier way of filter the errors out rather than having to go to each server and put in the event log error # to filter out. I see myself constantly having to do this as some Windows Updates produce more garbage errors. Of course I don’t want miss the important stuff like RAID or Domain Controller access or other critical stuff. Because there are so many variables in the Event Log, I’m not sure if there is an easier way. Thanx!

You can either set filters to drop the logs you're not interested in, or filters to catch the ones you are interested in. Usually, you can say 'just error status or worse' but of course, you've no way to know what the log messages might be.

If you have a lot of machines to manage, consider using a Windows Policy (or just a login script that runs a registry patch) to push out standard settings -- the filters are kept in the Registry, so you can dump the relevant section and automatically duplicate it around your servers, rather than manually set up filters everywhere.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Hi
Read About easy Filtering of Windows Log Events. if you want to know how to filter events by event description check this article