Importing Log Files


 

The Imported Log Files link lets you import a windows event log file (type .evt format) (type .evtx format supported in Windows Vista and 2008 machines only) from the local machine or remotely, through FTP.

You can import the following log files:

Importing Event Log and Application Log files are explained below.

Importing Event Log File

  1. Select the Settings tab. In the System Settings section, click the Imported Log File link.
  2. Select the Event Log Imports / Application Log Imports tab, and click the Import Log File link on the right side, to import a new event/application log file. The procedure to import the log files for both Event Logs and Application Logs remain same.
  3. Choose Local Host if the event log files are present in the local machine from where you are accessing the EventLog Analyzer server.
    1. Select the log format from the Choose Log Format combo box (Windows EventLog, IIS W3C Web Server Logs, IIS W3C FTP Logs, MSSQL Server Logs, DHCP windows logs, DHCP linux logs, IBM AS/400 Logs, Syslog, EventLog Analyzer Archive).
    2. Select the Time Interval (Import Once, Import Every Hour, Import Every Day). Select Import Every option and enter __ Min after which EventLog Analyzer should retrieve new log files.
    3. Enter the File Location in the text box or click Browse to locate the log file.
    4. Select the Log Type (Application, Directory Service, DNS Server, File Replication Service, Security, System) based on the type of event log you are importing.
    5. Select the option Want to Specify Time Criteria? if you want to import log file during a specific time period. Select the From and To dates using the Calendar icon besides the fields.
    6. Select the option Create Throw Away Reports if you do not want to store the imported event log file for more than 2 days. After 2 days the Throw Away reports are automatically removed from the Imported Log File listing page.
    7. Finally click Import to import the log file into the database. The time taken to import a log file depends on its file size.
  4. Choose Remote Host if you need to import the event log files from a remote location on the network.
    1. Select the log format from the Choose Log Format combo box (Windows EventLog, IIS W3C Web Server Logs, IIS W3C FTP Logs, MSSQL Server Logs, DHCP windows logs, DHCP linux logs, IBM AS/400 Logs, Syslog, EventLog Analyzer Archive).
    2. Select the Time Interval (Import Once, Import Every Hour, Import Every Day). Select Import Every option and enter __ Min after which EventLog Analyzer should retrieve new log files.
    3. Click Select Remote File link to locate the log file. Enter the remote host's hostname or IP address, and the FTP user name and password. Select the Protocol to be used from the combo box: FTP or SFTP/SSH. Enter the remote host's FTP Port (Default port for FTP will be 21 and for SFTP/SSH will be 22). You can click the List Files link to locate the file on the remote computer. Select the location on the remote machine where the log file or the entire directory containing the log files is present.
    4. Select the Log Type (Application, Directory Service, DNS Server, File Replication Service, Security, System) based on the type of event log you are importing.
    5. Select the option Want to Specify Time Criteria? if you want to import log file during a specific time period. Select the From and To dates using the Calendar icon besides the fields.
    6. Select the option Create Throw Away Reports if you do not want to store the imported event log file for more than 2 days. After 2 days the Throw Away reports are automatically removed from the Imported Log File listing page.
    7. Finally click Import to import the event log file into the database. The time taken to import a log file depends on its file size.
attention

If you importing an event log file which is much older than the configured DB Storage option, then such imported event log files are automatically considered as Throw Away Reports.

 

 

Note

Importing Application Logs

  • You can associate the application logs with the existing hosts. Enter the host name in the Associate To Host text box. Alternatively, click the Existing Host link besides the text box. Clicking the link will pop-up List of Existing Hosts screen. On the top there is a provision to search hosts. The hosts are listed below the search option. Select the host and click Select button. Click Cancel button to cancel the associating to host operation.
  • Some Applications create log file with new name (with time stamp appended) everyday. If the Application log files are to be imported from remote machines, you do not have to change the filename daily, instead select the Does filename change periodically? option while importing the logs. Selecting the option displays the the Filename Pattern: combo box to select the time stamp pattern that the server appends when the server creates the log file daily. You can also enter new pattern using the 'blue plus' icon. Select the pattern as required. A help tip icon displays, (when you click the icon) the mapping of the Timestamp in Filename to the Pattern to be given.

 

 

Automatic FTP Scheduling:

Importing of logs with periodic name changing of log files from both local and remote sources can be automated.

Select or select & enter the Time Interval (Import Once, Import Every Hour, Import Every Day, Import Every __ Min) after which EventLog Analyzer should retrieve new log files.

 

The Imported Log Files listing page shows you the list of windows event log files imported, along with details such as the following for each imported event log file.

 

Column Head Description
FileName Name of the imported event log file. Click on the Error in displaying log message icon to know the details of errors while importing the event log files.
HostName Host which generated the event logs.

LogType

The event log type can be Application, Security, System, Directory Service, DNS Server, or File Replication Service.

ImportType Whether the event log file has been imported from the local machine or remotely (remote machine name or ip) through FTP.
ImportedTime Timestamp at which the event log file was imported.
LogRecord StartTime Time stamp of the first collected log record in the imported event log file.
LogRecord EndTime Time stamp of the last collected log record in the imported event log file.
Report Type The type of custom report that will be generated. The Report report type can be Active or Throw Away.
Action Click on the Load & Search Load & Search link to load the event log file into the EventLog Analyzer database. (MySQL/MSSQL)
Click on the Load & Search Search link to search through the DB for matching criteria. The search criteria can be Source, Severity, Message, Event ID, Type (or Facility).
Click on the Drop Tables DropDB link to drop the imported log file table.

 

Importing Application Log File

The Application Log Imports tab of the Imported Log Files listing page shows you the list of application log files imported, along with details such as the following for each imported application log file.

 

Column Head Description
File Name Name of the imported application log file. Click on the Error in displaying log message icon to know the details of errors while importing the application log files.
Format Description The log format is indicated here.
Remote Host Remote Host from where the application log file has been imported.

Status

Indicates the status of file import. Various status are listed below.

Imported Time The time stamp at which the application log file was imported.
Size The size of the imported application log file.
Time Taken The time taken to import the application log file.
Action Click on the Load & Search Load & Search link to load the event log file into the inbuilt MySQL DB.
Click on the Load & Search Search link to search through the DB for matching criteria. The search criteria can be Source, Severity, Message, Event ID, Type (or Facility).
Click on the Drop Tables DropDB link to drop the imported log file table.

 

Viewing Data from Imported Files

Once the imported is fully loaded into the database, click the Search link to search for specific data in the archive. In the popup window that opens, carry out the following:

Select 'Match any of the following' or 'Match all of the following' for using the criteria. You can enter a maximum of four criteria. Enter the criteria for the data, such as the Source, Severity, Message, Event ID and Type.

Choose the time interval for which you want to see the data that meets all the criteria. Click Generate Report to view the records that match the criteria that you have specified.

You can export this report to PDF and CSV formats. Click Export to: PDF PDF format icon or CSV CSV format icon on the right top corner of the report page. You can also export the Throw Away reports to PDF and CSV formats.

 

 

Status of File Import

attention All Imported Log Files will automatically get listed on the Archived Files page, except Application Logs.

Copyright © 2012, ZOHO Corp. All Rights Reserved.
ManageEngine