Enterprise Event Log Viewer

The Enterprise Event Log Viewer (EEL Viewer) allows you to monitor events in the Enterprise Event Log (EEL). EEL can be configured to monitor a variety of events across the enterprise. For more information on EEL, see About Enterprise Event Log. EEL Viewer can also be used to monitor events in the Windows NT event log.

  • For help with specific tasks, see How to.
  • For general background information, see Concepts.


How to...

  • View event logs
  • Customize the view of event logs
  • Search for events


View Event Logs

  • View an event log
  • View more details about an event


View an event log

To view an event log

  1. Click Connection to expand the Connection window.
  2. In the Connection window, select either Enterprise Event Log or NT Event Log.
  3. In the Computer edit box, type the name of the computer that the log resides on.
  4. Click Connect.

Notes

  • If you do not specify a computer name, the log for the local computer is displayed by default.
  • If a different user name and password are required to view a log for a remote computer, EEL Viewer must be launched using these credentials.


View more details about an event

To view more details about an event

  • Double-click on an event to display event details in the drill-down window across the bottom of EEL Viewer.

Notes

  • To hide the drill-down window, click the X in the top right corner of the drill-down window.


Customize the View of Event Logs

  • Choose fields to display
  • Modify the sort order of fields


Choose fields to display

To choose fields to display

  1. Click the Customize button in the top right corner of EEL Viewer.
  2. In the Available fields list box (under Choose Column Order), select the field you want to display and click Add.
  3. In the Selected fields list box, adjust the order of the fields by highlighting a field and clicking Move Up or Move Down.
  4. Click Apply

Notes

  • To remove a field, highlight the field in the Selected fields list box and click Remove.
  • You can restore the default field settings by clicking the Restore Default button.


Modify the sort order of fields

To modify the sort order of fields

  1. Click the Customize button in the top right corner of EEL Viewer.
  2. In the Available fields list box (under Field Sorting), select the field you want to sort and click Add.
  3. In the Selected fields list box, adjust the priority of the fields by highlighting a field and clicking Move Up or Move Down.
  4. Determine how fields are sorted by selecting either Sort in ascending order or Sort in descending order.
  5. Click Apply.

Notes

  • To remove a field, highlight the field in the Selected fields list box and click Remove.
  • Data can be sorted on multiple columns by adding more than one field to the Selected fields list box. Fields are sorted by priority according to the order they are listed.
  • Sorting can be applied on a field that is not visible in the table view.
  • You can restore the default field settings by clicking the Restore Default button.


Search for Events

To search for events

  1. Click Search to expand the Search window.
  2. Enter the search criteria using the available fields.
  3. Click the Execute button to run the query.

Notes

  • You can re-run a query when the Search window is closed by clicking the Refresh button.
  • To save a query, type a name in the Save as edit box and click Save.


Concepts

This section provides general background information about EEL Viewer:

  • About Enterprise Event Log


About Enterprise Event Log

Enterprise Event Log (EEL) is a WMI-based storage of historical records for events that occur across the enterprise. These events include NT event log messages, SNMP traps, and application-generated notifications.

Depending on the size of the enterprise, you can configure EEL reporting to scale by implementing middle tiers for processing EEL data. The events logged on each tier are rolled up to the next higher tier according to policy rules. Middle tiers can be configured to filter and collate events. Middle tiers can also be configured to generate new events based on thresholds and the correlation of events.

For example, an enterprise may have servers at each site to log events from the data servers included in that site. Based on policy rules, some of the events logged on the site server are then rolled up to the regional server. Most critical events may then be shipped to the central management server, where they are logged for monitoring the health of the entire enterprise network and for historical analysis.

Use EEL Viewer to view EEL events on a local or remote computer. However, EEL Viewer cannot be used to configure which EEL events are generated and how they are processed.


Interpreting Events

EEL Viewer displays these types of events:

Error

A significant problem, such as loss of data or loss of functionality. For example, if a service fails to load during startup, an error will be logged.

Warning

An event that is not necessarily significant, but may indicate a possible future problem. For example, when disk space is low, a warning will be logged.

Information

An event that describes the successful operation of an application, driver, or service. For example, when a network driver loads successfully, an Information event will be logged.

Success Audit

An audited security access attempt that succeeds. For example, a user's successful attempt to log on to the system will be logged as a Success Audit event.

Failure Audit

An audited security access attempt that fails. For example, if a user tries to access a network drive and fails, the attempt will be logged as a Failure Audit event.


About Enterprise Event Log

Enterprise Event Log (EEL) is a WMI-based storage of historical records for events that occur across the enterprise. These events include NT event log messages, SNMP traps, and application-generated notifications.

Depending on the size of the enterprise, you can configure EEL reporting to scale by implementing middle tiers for processing EEL data. The events logged on each tier are rolled up to the next higher tier according to policy rules. Middle tiers can be configured to filter and collate events. Middle tiers can also be configured to generate new events based on thresholds and the correlation of events.

For example, an enterprise may have servers at each site to log events from the data servers included in that site. Based on policy rules, some of the events logged on the site server are then rolled up to the regional server. Most critical events may then be shipped to the central management server, where they are logged for monitoring the health of the entire enterprise network and for historical analysis.