Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I manage several windows web servers with .net web applications installed on them that log any errors to the event viewer. To view the event viewer I remote to each of the web servers and access it from here.

I am looking for an application that I can install on my local windows 7 PC that will enable me to view the event log of each of the servers without having to remote on to them? It would be just more convenient for me if this was possible or if such an application existed.

Anyone have any ideas on this?

share|improve this question

migrated from superuser.com Sep 8 '11 at 4:27

This question came from our site for computer enthusiasts and power users.

1  
Voted to move it to ServerFault. –  techie007 Sep 7 '11 at 22:00
add comment

4 Answers 4

The Event Viewer MMC snap-in like many other supports connecting to other computers.

Just right click on the "Event Viewer (Local)" root node and select "Connect to Another Computer...". I guess the "(Local)" bit is already a hint.

Make sure your current user have the appropriate privileges on the destination computer though. If necessary runnet use \\computername /user:username to get IPC access first.

share|improve this answer
    
Niall specifically asked how to avoid having to connect remotely to every one of his web servers :-) –  Lucky Luke Sep 12 '11 at 4:33
    
I think "remote onto them" means remote desktop as opposed to not connecting to the server at all. –  billc.cn Sep 12 '11 at 12:04
    
Good point, that's very possible he meant remote desktop. –  Lucky Luke Sep 15 '11 at 4:55
add comment

Another option is a tool like Snare to serialize the event log data and forward it to a snare server ($$) or syslog server.

Note that the raw event log data is sometimes semantically tied to the origin machine (some messages / contents are by reference to software / files installed on the computer). I believe that this won't come up if you use the origin machine to view the logs as billc.cn suggests, but it does mean you can't necessarily just save the event log in the native format and open it elsewhere.

share|improve this answer
add comment

There are many third-party applications out there that enable this sort of functionality. You will pretty much need to choose between a log monitoring / consolidation product and an alternative event log reader on steroids (one that queries multiple servers without the need to connect to each and every one of them).

The former has the advantage of usually supporting enhanced features such as notifying you via email when events occur, enhanced reporting (e.g. statistics) as well as long-term archival. Since those products also store the events in their database, you are also insulated against connectivity issues between the local and the remote machines. Our product EventSentry offers such functionality (and much more if desired). Disclaimer: I work NETIKUS.NET ltd.

The latter (I have not evaluated any of these products, but I am speaking of experiences from reviews, screenshots, etc) are probably quicker to setup and cheaper - but with limited functionality.

Regardless of the solution you pick, I recommend against manually reviewing logs. It's a tedious and passive process. Instead notification is really the only way to reliably fix problems as soon as they occur. Plus, general health of your web servers should be monitored as well (disk space, performance, service availability, etc.).

Hope this helps.

share|improve this answer
add comment

You can read (even monitor) Event log on remote PC(s) using command line script (e.g. written with powershell). Also you can use filter to select your application log entries only (hope it it have specified 'source' filed).

Check some links for details:

http://technet.microsoft.com/en-us/library/ee176846.aspx http://blogs.msdn.com/b/powershell/archive/2009/05/21/processing-event-logs-in-powershell.aspx http://blogs.msdn.com/b/powershell/archive/2006/04/25/583266.aspx

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.