Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Was just wondering how you Sysadmins monitor Windows Events logs on multiple servers. What apps are recommended and what should I be looking for?

I'd imagine there must be something that can forward all logs to one console and then group and display them by type and severity, Id imagine the ability to clear and save the event logs would be great too?

I am on a Windows 2003 domain with 80 Windows Server 2003.

share|improve this question

closed as not constructive by joeqwerty, HopelessN00b, Greg Askew, John Gardeniers, Tom O'Connor Nov 13 '12 at 12:55

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

Snare Agent + Kiwi Syslog Server + Splunk. – quanta Aug 4 '12 at 14:21
up vote 1 down vote accepted

Totally depends on your environment, and many resources you're willing to throw at the problem.

If you have a very large environment, it's almost a requirement that you use some sort of log centralization or aggregation software. That can range from a full-fledged, expensive piece of enterprise-grade software to custom scripts that copy log files to a central "log server" and scan through the for warnings or alerts.

If you have an enterprise-grade monitoring suite, you can usually roll Event Log monitoring into it if desired, though you may not want to. After all, the monitoring system will alert you to problems, so adding all your Event Logs to it could start to create a case of information overload.

Or, if you're in a smaller environment (as it sounds like you are), there may not be a need for anything beyond what you can find natively in Windows.

I was a one-man IT department at a shop with only about a dozen Windows servers a while back, and no budget for software, of course, so my solution to Event Log monitoring was a simple script that opened the Event Log Viewer, connected to all the remote server Event Logs, and applied a filter to only show me warnings and errors. I ran that first thing every morning, and it became part of the daily checklist of things to do to keep the environment limping along for one more day.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.