Event Viewer and Event Forwarding
Event Viewer is a tool used to monitor the health of the computer. Event Viewer has had a significant overhaul in Windows Vista and is now closely integrated with Task Scheduler and the Reliability and Performance Monitor. You can access Event Viewer in Administrative Tools and use it to perform the following functions:
- View and filter events from a multitude of preconfigured logs.
- Create and save custom event filters and views.
- Configure tasks to run in response to specified events.
- Configure and manage event subscriptions.
The preconfigured logs fall into two categories—Windows Logs and Applications and Services Logs—as shown in Figure 3.26.
Figure 3.26 The main window in Event Viewer shows the Windows Logs and Applications and Services Logs.
As you expand Applications and Services Logs > Microsoft > Windows, you discover dozens of additional, preconfigured event logs. These logs address specific services and features of the operating system and can be used to identify problems, before they start, as well as provide diagnostic and troubleshooting information after something unexpected has happened.
There are two more collections of logs available within Event Viewer:
- Analytic Logs—Describe program operations and indicate problems that cannot be addressed with human intervention. Analytic logs generate a high volume of output.
- Debug Logs—Used to help developers troubleshoot issues with their programs.
Event Forwarding is used to consolidate events from multiple computers, called Source computers, onto a single monitoring station, called the Collector computer. Event types include all the event categories in the Windows Logs and Applications and Services Logs. Both Source and Collector computers must be specially configured for Event Forwarding to be successful.
Source Computer Configuration
On the Source computers, you must configure the Windows Remote Management utility by executing the following command at an elevated privilege command prompt:
This command makes some changes to your system, including setting the WinRM service to auto start; creates a WinRM Listener on HTTP to accept Web Services for Management (WS-Man) requests—a mini, nonuser-configurable web server); and opens the firewall for WinRM services.
You must also add the computer account of the Collector computer to the local Administrators group on each Source computer.
Collector Computer Configuration
On the Collector computer, you must configure the Windows Event Collector Utility by executing the following command at an elevated privilege command prompt:
This command initializes the Windows Event Collector on the Collector computer. Now you are ready to create subscriptions on the Collector computer to Source computer events.
To configure subscriptions, in Event Viewer on the Collector computer, right-click Subscriptions in the left pane and select Create Subscription. The Subscriptions Properties page is shown in Figure 3.28.
Figure 3.28 Configuring an event subscription on the Collector computer.
By clicking Select Events, you see that events can be largely unfiltered to acquire large amounts of data or finely filtered to acquire only a very specific and smaller number of events. The Query Filter dialog box for the Subscription is shown in Figure 3.29.
Figure 3.29 Configuring a Query Filter to limit the types of events collected on the Collector computer.
The Advanced button on the Subscription Properties dialog box allows for the configuration of the account that will read the log files. This account must have permissions to access the log files and is the typically the computer account that you placed in the local Administrators group on the Source computers. You can also configure the forwarded event delivery for Bandwidth or Latency optimizations.