Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for a Windows eventlog analyzing and monitoring software for Windows Server 2000/2003 (there are some new features in Windows Server 2008.) The feature set should include:

  • real-time monitoring (alerts via email or other messages)
  • definition of events/event groups which are watched
  • multiple-server
  • reporting (daily/weekly etc. reports)
  • nice client tools
  • not necessarily free or open-source, but that would be nice (of course)

Any recommendation or tip how to implement this using standard tools?



locked by Chris S Aug 26 '12 at 4:09

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

Shopping Questions are Off-Topic on any of the Stack Exchange sites. See Q&A is hard, lets go Shopping and the FAQ for more details. – Chris S Aug 26 '12 at 4:08
up vote 5 down vote accepted

I would suggest you use OSSEC. It can agregate all the information in a single server and has a nice web interface that allows you to display the alerts.


Zenoss Core...

Here is a link: – splattne May 29 '09 at 16:14
+1, specially if you setup an email alerting rule based on "Event Class Key" – l0c0b0x Jul 8 '09 at 20:31

I use a set of custom Perl scripts. They do several things but the main one goes through the event logs of each of the servers, extracts the warnings and errors for the last 24 hours, creates an Excel spreadsheet with the results and puts that in a folder I check each morning. This way I get the interesting bits in an easy to read format.

I'm currently considering the practicality of integrating event log monitoring with Nagios. With the right kind of ignore filters (e.g. I really don't care that a print job failed) I should only receive alerts that need to be looked into. That's a fair bit of work to set up but I only need to do it once and it will make my job easier long term. Alternatively, I may have another look at Zenoss.


I can recommend NOT using GFI event manager. It's a huge bandwidth hog (streams entire logs over the wire repeatedly) and if you have t1 remote sites, this is a big deal. Also, it's flaky, so it requires far too much upkeep for what should be a simple solution.

SecureWorks has a solution that we will be trying. It looks pretty good.


Splunk (


Event Tracker


Not the answer you're looking for? Browse other questions tagged or ask your own question.