Which events should I setup to be notified about in order to:

  • be notified if something that needs to be fixed is detected
  • be notified in particular about various disk problems and other hardware problems
  • not be spammed about unimportant events

What would a typical list of such events look like?

  • I can't believe that this is an actual question. As a start you probably want to be notified on Critical, Warning and Error events. You can then determine if that fits your need and adjust accordingly.
    – joeqwerty
    Sep 24 '13 at 15:03
  • @joeqwerty if I were to get notified about all warning and error events I will get spammed by hundreds of notifications per day. How do I get only the important ones?
    – tomsv
    Sep 24 '13 at 15:30
  • There are 5 event levels: Critical, Warning, Error, Information and Verbose. If you don't want a notification for all Critical, Warning or Error events then you're going to have to "filter" only the ones you want from each level one by one. There isn't any way to say "I only want these Warnings but not these other Warnings", without manually selecting them. The Event Logs aren't sentient, they don't know which events from each level that you want and which you don't want. You will have to go through the Event logs event by event and select only the ones you want to be notified on.
    – joeqwerty
    Sep 24 '13 at 15:37

This is actually a pretty common question, and unfortunately there is no such list. Now, there are some lists out there (some from software vendors, some from community web sites, user groups, etc.) but I would only use them as a starting point - if at all.

IMHO, relying on a fixed list of events is a bit dangerous, unless you have full control of the software generating the events (e.g. software developed in-house). Without that knowledge, you are bound to miss events which may be critical.

It's my experience that it's almost impossible to anticipate all the critical events in a network, and setup the according rules for the following reasons:

  • Events are often not documented well by software vendors, if at all.

  • Even when events are documented, it's often not clear which events are critical and which are not (the severity in itself is often not indicative of that).

  • Events can change from version to version, so events from ABC Software v1 may be different to events from ABC Software v2. So the event list that was so careful created for v1 may be obsolete for v2, and a critical event created in v2 would be ignored.

  • Software & Hardware vendors often use a single template for events, and insert the actual event contents dynamically (as opposed to using Microsoft's event logging framework correctly, which is actually quite good), making it impossible to predict what events are logged unless you have access to the source code.

There is no standardized way to obtain a list of events, and therefor importing/inputting numerous events would be very time consuming. It's for that reason we have taken the approach to include all Warning & Error events by default in our event / log monitoring software EventSentry, and then have the end user exclude the noise.

We also ship with a fair amount of default exclusions (so we have a "list"), to reduce the noise as much as possible and give our users a head start. This approach results in a little more work, but it assures that critical events will never be missed. If you are diligent, you can usually be done with the customization in a week, since most alerts which can be ignored occur on a regular basis. This approach has worked reasonably well for our customers over the years.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.