WMI Event Log Sensor does not show all Logfiles | Paessler Knowledge Base

link管理

链接快照平台

输入网页链接，自动生成快照
标签化管理网页链接

What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general. You are invited to get involved by asking and answering questions!

Learn more

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

hello,

i would love to monitor "Microsoft-Windows-Backup" (%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Backup.evtx), but PRTG only shows "Application, HardwareEvents, Security, System, ...". How could i implement this?

thanks!

event-log logfiles Created on Aug 9, 2021 11:40:15 AM by

Hello,

Thank you for your message.

To monitor the log file "Microsoft-Windows-Backup" with the WMI Event Log sensor, I invite you to have a look at the article below which explains how to add log file to the "Win32_NTLogEvent" WMI class (used by the sensor).

https://docs.datadoghq.com/integrations/faq/how-to-add-event-log-files-to-the-win32-ntlogevent-wmi-class/

The log file should then be visible in the list provided by the meta-scan of the sensor.

If you have questions, let us know.

Regards.

Add comment

When I add the WMI Event Log sensor it doesn't show the Security log as an option. I read the article linked above. When I run that query a Security log entry is returned. So, the Security log is in the Win32_NTLogEvent class.

I also checked the permissions for the Security log compared to the Application and System logs, which do show up when I add the sensor. The permissions match for all three.

Please advise.

Add comment

Hi there,

I just tested it with the latest version .82 of PRTG and the WMI Eventlog Sensor lists the Security Event logs. Do you use an administrator in the Credentials for Windows Device settings of the parent device?

Kind regards,
Felix Saure, Technical Support Team

Add comment

Thanks for replying.

We are not using an administrator level account. The domain account we are using is part of the local Event Log Readers, Performance Monitor Users and Performance Log Users groups.

We're trying to avoid just using a domain admin given the security implications.

Thanks again.

Add comment

Hello MGClark,

The access rights are defined by Microsoft, if you enter a Domain Admin for a test, does this work correctly?

I'm afraid that we do not have a whitepaper nor do we know a particular guide of Microsoft what exact user rights it will require for the monitoring. If you find any, let us know and we can consider to update the documentation accordingly.

Kind regards,
Felix Saure, Technical Support Team

Add comment

Note from Paessler:
Please ensure that you take a close look at the parameters which are set in the provided calls to change the access rights of the EventLogs, as these could provide a false sense of security if they grant access to classes to which a regular user account would not have access to. Thanks for sharing mgclark!

Success!

I found this page that had the wrong permission changes to access the Security log remotely. So, the user account is not a domain admin and the sensor works as expected.

https://girl-germs.com/?p=1538

Add comment

推荐文章

谈吐大方的镜子 · ibdata1 HUGE despite innodb_file_per_table being set - Other MySQL® Questions - Percona Community Fo

5 小时前

个性的炒饭 · [solved] MySQL service issue - corrupted ibdata1 file - Support - YunoHost Forum

5 小时前

正直的番茄 · 查看提交历史 | Pro Git 中文版

13 小时前

威武的长颈鹿 · Can CPLEX solve a problem with a logarithm in the objective function (e.g. optimize entropy) | Decis

2 天前

从容的镜子 · 在linux中创建每日日志脚本_NLog -在linux中的特定目录下创建日志文件_在shell脚本中创建数组 - 腾讯云开发者社区 - 腾讯云

3 天前

道上混的野马 · “地产明星”被疑雇凶杀死“接盘人”_新浪地产网

4 月前

睿智的牛肉面 · Tokio_tungstenite: WebSocket protocol error: Handshake not finished - The Rust Programming Language

5 月前

安静的手套 · 材料计算笔记本 - 知乎

6 月前

千杯不醉的脆皮肠 · sts git怎么更新文件夹 • Worktile社区

7 月前

星星上的泡面 · 6. Global Filters

1 年前