Please Note: This article is valid for EventReporter in addition to WinSyslog!
Windows NT/2000/XP/2003/Vista/2008/Windows 7 systems monitoring is really important for all small to large sized enviroments. MonitorWare line of products helps to accomplish this important task. This article is to help you establish a small setup to monitor your Windows systems.
This article is strictly task focused. It does not describe why the systems should be monitor nor does it provide any further background. Please see the respective backgrounders or each of the products documentation on this. This article is a step-by-step description of what you need to do in order to centrally monitor your Windows systems.
Centralized Event Reports
In this step-by-step guide, EventReporter is configured to work together with Adiscon’s WinSysLog and MoniLog to automatically generate event summaries for the monitored servers and other devices.
This guide focuses on a typical small to medium business topography with a single geographical location and 5 Windows clients and a central hub server. All systems are well connected via a local Ethernet. Event reports from all machines should be stored in a log file. The administrator shall receive daily consolidated event reports.
What you need
In this guide, I am focusing on building a solution with Adiscon’s EventReporter, WinSyslog and MoniLog. This combination allows you to centralize all your event logs and report events from them. Free 30 day trial versions are available at the respective product sites (links below), so you can try the system without the need to buy anything.
You need to run the following products:
- one EventReporter for each system that is to be monitored. In our scenario, this means 6 copies, one for each client and one for the central hub server to be monitored. (if you want to monitor the hub server as well.)
- one WinSyslog to receive and store event reports from the EventReporter monitoring agents.
- one MoniLog to automatically generate consolidated reports based on the gathered log data in a file.
Note: Please note that to deliver MoniLog reports, you need a local web server (for example Microsoft’s IIS or Apache) and a mail server capable of talking SMTP (most modern servers support this). Make sure that you log on to each machine with a sufficiently privileged user account.
MonitorWare Console
MonitorWare Console can also be used with EventReporter and WinSyslog. MonitorWare Console is a very strong and comprehensive tool that will help you out in carrying out sophisticated analysis of your system. For more information about MonitorWare Console, please refer to its manual and to have a clear idea about Monilog and MonitorWare Console reporting features, please visit Comparision of Monilog Report and System Status Report of MonitorWare Console.
Step 1 – Download Software
Please check the web sites for new versions of respective products if you downloaded your copies a while ago. Security and monitoring is a short lived business, and new product versions can appear quickly.
Please visit www.eventreporter.com/en/download and www.winsyslog.com/en/download to download the latest versions of EventReporter and WinSyslog respectively. In addition to these, you also need the MoniLog product. A free, full-featured 30 day trial is available at www.monilog.com/en/download/.
Step 2 – Install WinSyslog
Identify the system on which WinSyslog (and probably MoniLog) should run on. Take a note of its IP address or host name. You’ll need this value when configuring the EventReporter clients. For our example, I assume this system has an IP address of 192.168.1.0.
Run the WinSyslog setup with default parameters. When setup has finished, WinSyslog automatically is configured to operate as a simple Syslog server. However, it does not yet use file logging as we need that. We’ll later setup WinSyslog to write data into a file and also to configure Syslog server service, if you do not have it.
Step 3 – Install EventReporter
Run the EventReporter setup program on all systems that should be monitored. This means you need to run it on all 5 clients and the central hub server.
For larger installations (with many more servers) there are ways to set it up in a simpler fashion, but in a scenario like ours, it is faster to install it on each machine manually. You can install it with the default settings. When setup has finished, the program automatically is configured to operate as a simple EventReporter. However, it does not yet forwards the log to Syslog server. So we will go ahead and change this on each of the machines or by launching it on one machine and remotely connecting to the others. It is your choice. In this sample, I use the EventReporter on each machine (it is easier to follow). We will also see configuring an event log monitor service, if you do not have it.
Step 4 – Install Monilog
A standard setup program installs the application. The install set (the ZIP file you downloaded) contains a standard setup program and it’s necessary helper files. Please unzip the archive to any directory you like. After unzipping, simply double-click “setup.exe” and follow the onscreen instructions.
There are also self extracting exe files available for download. If you downloaded these versions, there is no need to separately unzip the program. The self extracting version might also start the setup process automatically. If you have Windows Installer already present on the target system, you can also setup the product by simply double clicking the .MSI file. Windows Installer is present on all Windows 2000 systems.
Step 5 – Create a RuleSet to Forward by Syslog (EventReporter)
Please note that delete the previous services or rules sets to follow or save those to registry file not binary for later use. To save your settings follow the link and just dont zip & send that file to us.
The steps to configure the EventReporters are as follows (repeat this on each of the 5 client machines). This step needs not to be done on the central hub server as well!:
1. Start EventReporter.
2. Select your language – in this example, I use English, so it might be a good idea to choose English even if that is not your preference. You can change it any time later, but using English makes it much easier to follow this guide here.
3. Then define a new rule set, right click “RuleSets”. A pop up menu appears. Select “Add RuleSet” from this menu as shown below:
4. Then, a wizard starts. Change the name of the rule to whatever name you like. We will use “Forward Syslog” in this example. The screen looks as follows:
Click “Next”. A new wizard page appears.
5. Select only Forward by Syslog. Do not select any other options for this example. Also, leave the “Create a Rule for each of the following actions” setting selected. Click “Next”. You will see a confirmation page. Click “Finish” to create the rule set.
6. As you can see, the new Rule Set “Forward Syslog” is present. Please expand it in the tree view until the action level of the “Forward Syslog” Rule and select the “Forward by Syslog” action to configure.
7. Replace the message format from the original syslogformat to MoniLog format. To do so, click on “Insert” and then “Replace with MoniLog Format”. Also, please uncheck “Add Syslog Source when forwarding to other Syslog servers” Option and type the IP address or host name of our central hub server in the “Syslog Server” field:
8. Make sure you press the “Save” button – otherwise your changes will not be applied.
Step 6 – Create an EventLog Monitor to get all the Events from the Machine (EventReporter)
1. First, please rightclick on “Running Services” node in the left treeview (TOC). Select “Add Service” and then “Event Log Monitor” in the opened popup menu:
2. A wizard should open up, which looks like the screenshot below. Here type the name of the “Event Log Monitor” (In our case we will name it “My EventLog Monitor”). Then click on “Finish”:
3. Now the properties tab of the newly created “EventLog Monitor” will open up. Please leave it at default settings and still change the “Rule Set to use” to our above created “Forward Syslog” RuleSet. Please do not forget to save the changes.
Step 7 – Create a simple Syslog server on WinSyslog
Please note that delete the previous services or rules sets to follow or save those to registry file not binary for later use. To save your settings follow the link and just dont zip & send that file to us.
The Syslog server will operate as a standard Syslog server on the default port of 514/UDP. All incoming data will be written to a single text file.
Step 8 – Defining a Rule Set for File Logging
The rule set specifies what action to carry out. You might be tempted to define the service first, but starting with the rule set makes things easier as it will be already present when the service is defined later and needs to be bound to a rule set.
To define a new rule set, right click “Rules”. A pop up menu will appear. Select “Add Rule Set” from this menu. On screen, it looks as follows:
Then,a wizard starts. Change the name of the rule set to whatever name you like. We will use “Write Syslog Log File” in this example. The screen looks as follows:
Click”Next”. A new wizard page appears:
There,select file logging. Do not select any other options for this example. Also, leave the “Create a Rule for each of the following actions” setting selected. Click “Next”.
This is just a confirmation page. Click “Finish” to create the rule set.
The wizard closes and the client shows a newly created rule set.
As you can see, the “Write Syslog Log File” rule set is now present. Please expand it in the tree view until you have the following screen contents:
As you can see, we have a “File Logging” action configured. We will review the settings just for your information. Click on “Filter Conditions”:
As you can see, none of the filter conditions are enabled. This means that all information units (incoming messages) will be matched by these filter conditions. As such, the rules for the “File Logging” action will always be carried out.
Please note that this also means that all Syslog priorities and facilities will be written to the same file.
Now let us check the “File Logging” action itself. Please select it in the tree view:
Please enter a “File Base Name”. In our case we will name it “EventReporter”, cause all the Data comes from EventReporter’s. Its also important to make sure that the directory you specify exists! If it does not yet exist, please create it before you start the service. If the directory does not exist, the service is not able to store any files, last but not the least, do not forget to save the changes you do.
Note:Do NOT change anything else in the “WriteToFile-Action Configuration”!
Now you have a workable rule set for logging incoming messages to a text file.
Step 9 – Create a Syslog Server Service
Now we need to define a Syslog server service. A Syslog server is also sometimes called a “Syslog daemon”, “Syslogd” or “Syslog listener”. It is the process that receives incoming messages.
To define it, right click on “Services”, then select “Add Service” and the “Syslog Server”:
Once you have done so, a new wizard starts:
Again, you can use either the default name or any one you like. We will use “My Syslog Server” in this example. Leave the “Use default settings” selected and press “Next”:
As we have used the default, the wizard will immediately proceed with step 3, the confirmation page. Press “Finish” to create the service. The wizard completes and returns to the configuration client. There, you will see the newly created service beneath the “Services” part of the tree view:
To check its parameters, select it:
As you can see, the service has been created with the default parameters. As such, it operates as a RFC compliant standard Syslog server.
Please note that the “Write Syslog Log File” has been automatically assigned as the rule set to use. This is the case because we already created it and it is the only rule set. By default, the wizard will always assign the first rule set visible in the tree view to new services. If another one is to be used, you need to change it to the correct one here in the service definition.
Also, note that the wizard uses the default properties from the “Service Defaults”. Obviously, if these are changed, the default properties for new services will differ.
This procedure completes the configuration of the Syslog server. Please do not forget to click save button and changes will start working after application restarts.
Monilog for Reporting
To deliver MoniLog reports, you need a local web server (for example Microsoft’s IIS or Apache) and a mail server capable of talking SMTP (most modern servers support this). Please make sure you log on with a sufficiently privileged user account.
Preparing Web Server for MoniLog
MoniLog publishes its reports through the local web server (central hub server).
To avoid confusion, we recommend creating a separate directory on the web server for MoniLog. Let us assume you use Microsoft Internet Information Server and run it in the default configuration. Then, you web pages are stored in the c:\inetpub\wwwroot directory. Create a subdirectory “monilog” directly beneath this directory.
Configuring Monilog
When setup has finished, start MoniLog, select your language (I have used English for this tutorial) and perform the following steps:
1. First, switch to the “General” tab.
2. “Logs Location” expects the DSN or Location where logs are dumped. You specify the location for your log file. Here we specify location of log file.
3. Select your “Select Syslog server type”.
4. Change the “Log prefix/Log name label” to the prefix you defined in your “WriteToFile” action in WinSyslog. In our case we named it “EventReporter”.
5. Next is to check the “Process Non-Windows Syslog messages” box. Leave all other options by default. Now it should look as follow:
Figure 1: General Tab Settings Form – For Log Files
Click “Apply” after making your changes!
5. This has already enabled MoniLog reporting. Now, we can verify the installation. To do so, switch back to the “Profiles” tab. Click the “New Profile” button and enter a name. In this example I use the name “Profile 1”.
Figure 2: Creating New Profile
Click “OK” button to create a new profile.
6. Under “Reports Location”, enter the directory where MoniLog reports should be stored. In our sample, we use “c:\inetpub\wwwroot”. Leave all other settings as default. The tab should look like this one:
Figure 3: Configuring Reports Location
Click “Apply” to save your changes!
7. Next step is to set your report options. To do so, click “Report Options”. A new window opens. Check Success Audit and Information. Now it should looks like this one:
Figure 4: Report Options Form
Click on “OK” to close the windows by using default options.
8. Click “Analyze now” to test it. After a short while, a browser window with a MoniLog report will appear. The actual content of this report varies greatly. It depends on which events have been forwarded while setting up the agents. Probably, your report will be empty. This simply indicates that there was not yet any data to be analyzed. Immediately after setup, this is OK. If you don’t receive any data after some hours then of course there is something wrong. If that is the case, check the steps done before. A typical report looks like follows:
Figure 5: A typical Monilog report
9. Now we have verified the system is working. Next, we can schedule the automatic report. To do so, we need to check “Enable Schedule” and also “Enable Email delivery”. A quick reminder: we would like to receive a pointer to the report via email each working day. We first need to set the web directory the reports are to be stored to and enable email delivery. It is all done in the following screenshot:
Figure 6: Enabling Email delivery and report scheduling options
The “Email Options” and “Scheduled Options” become colored and are now available.
10. Now we need to configure the email options. Click “Email Options…”. We assume the web server (192.168.0.1) is also acting as a mail server. The emails should be sent to “admins@sample.adiscon.com”. With that, the dialog looks like follows:
Figure 7: Configuring Email notification settings
Important: make sure the values match your configuration! This is vitally important because otherwise MoniLog is incapable of sending email correctly. Click “OK” to apply the new settings.
11. Next, click the “Report Options…” button. As we schedule reports only on working days, we need to tell MoniLog that it should include all those events occurred since its last run into the reports. We cannot leave the default of 24 hours, as this would exclude the weekend’s events. So change the “Report Type” option to “From last run till now” as seen below.
Figure 8: Setting Report Options form
Click “OK” to apply the setting.
12. Lastly, click on “Schedule Options” to set a schedule. As long as no schedule is set, no reports will be generated automatically. In our sample, we let MoniLog generate reports each working day at 8:00 in the morning. Weekends are not enabled. The dialog looks like this:
Figure 9: Configuring report generation schedule
13. Click on “OK” to apply the settings.The MoniLog service has not yet been started. It generates the scheduled reports (so you don’t need to run the client in foreground).
14. To conclude your configuration of MoniLog, start the service. To do so, select “Service”, then “Start Service” from the menu. This will start the service. During setup, the service is set to start automatically with system startup. So there is no need to manually restart the service after a reboot.
MoniLog is now completely configured. You will not immediately receive reports, because they will only be generated at 8 am each working day. So you need to wait for the next morning. If you would like to change the schedule to have an immediate feedback, please go to “Schedule” and change the time to be a few minutes in the future. Then click “OK” and restart the service. This can be done via the “Service” menu. A restart is necessary because the service reads changed parameters at startup, only.
Please Note: The only difference between configuring your reports to be generated either from Log Files or on underlying database is Step 2. From Step 3 onwards settings are the same.
You are done!
Well, this is all you need to do to configure the basic operations. Once you are comfortable with the basic setup, you can enhance the system with local pre-filtering of event, enhanced logging and alerting (with EventReporter and WinSyslog ) and changing report options (with MoniLog / MonitorWare Console).
What is recommended setting for MoniLog and Why?
Let’s quote Rainer Gerhards, design lead for the overall MonitorWare line of products, here:
Typically, MoniLog should work with Log Files, and not with the database. As using files is the recommended way with MoniLog. Why is it recommended? Because it is much faster! Why do we support database, too? Because this allows easier integration e.g. with the Web Interface! Would I recommend MoniLog and database if a customer also needs to run the Web Interface? In most cases: No! From a performance point of view its better to create both text files and database content.