|
SB EventLog Monitor is tool for monitoring and consolidating Windows EventLogs.Events can be collected: - using VBS script, that will collect all events remotly via WMI - using Windows agent, that will collect all local events and send them over HTTP(s) to the server. After that, collected events are parsed using PHP and YOUR rules and are stored in MySQL database. There are two tables for this. All events are stored in the first one and in the second one only "Alerts" are saved. Alerts are Events, that matched against one of the rule. Alerts can be also send using email. Front end is web-based application with filtering and sorting. Eventlog Monitor has 3 partsCollectorFirst part is written in Microsoft VB script (executed using cscript) and used to collect EventLogs from computers using WMI (only new events are collected).OR You can use the Windows agent for collecting events. Windows agent must be installed on each monitored machine. This agent will collect events and will send them over HTTP(s) to the server.You can use both collecting methods together. ELM server can handle this.ParserThe second part is written in PHP and it will parse all collected events and will store them in MySQL database. The "parse" also run user-defined rules on each event, so important events can be send using email or just stored (copy) in different table - so no important event is missed. Rules can also mark event as "noise" and then this event is hidden from standard views.Web UIThe last part is web-based user interface for browsing the events and alerts. User can set filters, for better orientation. Web-UI is also used for configuring collector (which computers, how often, computer group); user control; rules creation and settings; cron control (how often are data parsed, when the old events can be deleted, ...).All is based on PHP(5.0 ), web server (apache, IIS) and vbscript (and WMI). Only one scheduled task must be created, to execute collector and "cron" (PHP scripts for parsing data, sending emails, ...). Collector must be run as user with administrative rights on monitoring computers! Requirements: - Web server - Apache / IIS on WINDOWS machine (Windows 2000, Windows XP and Windows 2003 are tested and supported) - PHP5.x - Required PHP's extensions: php_mysql.dll and SimpleXML (built in) - MySQL 4.x is tested. SB EventLog Monitor using only simple INSERT, UPDATE, DELETE commands, so no special features are required. ALL TABLES SHOULD BE IN UTF-8. - You have to add one entry into Windows "scheduled tasks". - Server should have administrative rights on monitored machines (only for collecting, so only "_run.bat" have to be run as domain admin).
|
Windows Software
Albina Merfyn - I find this to be really easy to use. I can...
