- Free Edition
- What's New?
- Key Highlights
- Suggested Reading
- All Capabilities
-
Log Management
- Event Log Management
- Syslog Management
- Log Collection
- Agent-less Log Collection
- Agent Based Log collection
- Windows Log Analysis
- Event Log Auditing
- Remote Log Management
- Cloud Log Management
- Security Log Management
- Server Log Management
- Linux Auditing and Reporting
- Auditing Syslog Devices
- Windows Registry Auditing
- Privileged User Activity Auditing
-
Application Log Management
- Application Log Monitoring
- Web Server Auditing
- Database Activity Monitoring
- Database Auditing
- IIS Log Analyzer
- Apache Log Analyzer
- SQL Database Auditing
- VMware Log Analyzer
- Hyper V Event Log Auditing
- MySQL Log Analyzer
- DHCP Server Auditing
- Oracle Database Auditing
- SQL Database Auditing
- IIS FTP Log Analyzer
- IIS Web Log Analyzer
- IIS Viewer
- IIS Log Parser
- Apache Log Viewer
- Apache Log Parser
- Oracle Database Auditing
-
IT Compliance Auditing
- ISO 27001 Compliance
- HIPAA Compliance
- PCI DSS Compliance
- SOX Compliance
- GDPR Compliance
- FISMA Compliance Audit
- GLBA Compliance Audit
- CCPA Compliance Audit
- Cyber Essentials Compliance Audit
- GPG Compliance Audit
- ISLP Compliance Audit
- FERPA Compliance Audit
- NERC Compliance Audit Reports
- PDPA Compliance Audit reports
- CMMC Compliance Audit
- Reports for New Regulatory Compliance
- Customizing Compliance Reports
-
Security Monitoring
- Threat Intelligence
- STIX/TAXII Feed Processor
- Threat Whitelisting
- Real-Time Event Correlation
- Log Forensics
- Incident Management System
- Automated Incident Response
- Linux File Integrity Monitoring
- Detecting Threats in Windows
- External Threat Mitigation
- Malwarebytes Threat Reports
- FireEye Threat Intelligence
- Application Log Management
- Security Information and Event Management (SIEM)
- Real-Time Event Alerts
- Privileged User Activity Auditing
-
Network Device Monitoring
- Network Device Monitoring
- Router Log Auditing
- Switch Log Monitoring
- Firewall Log Analyzer
- Cisco Logs Analyzer
- VPN Log Analyzer
- IDS/IPS Log Monitoring
- Solaris Device Auditing
- Monitoring User Activity in Routers
- Monitoring Router Traffic
- Arista Switch Log Monitoring
- Firewall Traffic Monitoring
- Windows Firewall Auditing
- SonicWall Log Analyzer
- H3C Firewall Auditing
- Barracuda Device Auditing
- Palo Alto Networks Firewall Auditing
- Juniper Device Auditing
- Fortinet Device Auditing
- pfSense Firewall Log Analyzer
- NetScreen Log Analysis
- WatchGuard Traffic Monitoring
- Check Point Device Auditing
- Sophos Log Monitoring
- Huawei Device Monitoring
- HP Log Analysis
- F5 Logs Monitoring
- Fortinet Log Analyzer
- Endpoint Log Management
- System and User Monitoring Reports
-
Log Management
- Product Resources
- Related Products
- Log360 (On-Premise | Cloud) Comprehensive SIEM and UEBA
- ADManager Plus Active Directory Management & Reporting
- ADAudit Plus Real-time Active Directory Auditing and UBA
- ADSelfService Plus Identity security with MFA, SSO, and SSPR
- DataSecurity Plus File server auditing & data discovery
- Exchange Reporter Plus Exchange Server Auditing & Reporting
- M365 Manager Plus Microsoft 365 Management & Reporting Tool
- RecoveryManager Plus Enterprise backup and recovery tool
- SharePoint Manager Plus SharePoint Reporting and Auditing
- AD360 Integrated Identity & Access Management
- AD Free Tools Active Directory FREE Tools
What is a log collection agent?
A log collection agent is software installed on a host (or on a nearby machine that can reach it) that captures logs locally, buffers them, and ships them to a central platform in real time. Because the agent lives on the network segment where the logs originate, it doesn't need the log collector to have inbound access. The agent initiates the connection outbound, over a single controllable port, in an environment where opening WMI or RPC across the firewall is not feasible.
In EventLog Analyzer, log collection using an agent is optional. By default, the solution deploys agentless log collection. If your enterprise IT security policy does not allow opening WMI ports, or when events need to traverse WAN links reliably, an agent-based path exists as an alternative to agentless collection.
Agent-based log collection
EventLog Analyzer ships a purpose-built log collection agent which runs alongside agentless collection rather than replacing it where both modes feed the same pipeline under one console. In agent-based collection, the logs from various sources are automatically fetched by the agent and transmitted to a central server.
Agent configuration and setup
Getting the agent running is a five-step operation from the admin console. There's no separate installer to run on the endpoint—EventLog Analyzer pushes the install remotely.
- In the EventLog Analyzer console, go to Settings > Log Source Configuration> Add Agent.
- Select the target device(s) from the discovered device list.
- Assign credentials with local admin rights on the target.
- Define the log sources to collect—Windows audit logs (Security,System, Application, or custom), file paths for text logs, and syslog listeners.
- Activate collection. The agent begins forwarding within seconds.
One agent handles up to roughly 25 Windows devices within its LAN. Assignment is flexible: A device can be handled by the agent directly, or the server can collect from it agentless, or it can be reassigned from one agent to another as the environment changes.
Agent-based log collection in Windows
Once installed, the agent reads events directly from the Windows event log service on each assigned host. It uses the native Windows Event Log API rather than WMI, which is the main reason it works where agentless doesn't. No WMI ports need to be opened on firewalls between the source and collector. The agent forwards events to the EventLog Analyzer server continuously in real time. Transport is via TCP, initiated outbound from the agent.
Refer to the event log collection page for more details on collecting Windows logs in EventLog Analyzer.
Agent-based log collection in Linux
When it comes to Linux or Unix hosts, the agent auto-detects the local syslog daemon and configures forwarding to the EventLog Analyzer server without hand-editing configuration files. The syslog port and protocol are configurable per device, so the agent can be pointed at whatever port the local network policy allows.
Agent-based vs. agentless log collection
Neither mode is universally better. Both are supported for a reason. The right question is: Which one applies to this specific device, on this specific network segment, under this specific policy?
Use the agent when: the device is behind a firewall that doesn't allow WMI or RPC inbound; the connection to the collector is a WAN link with latency or packet loss; enterprise policy prohibits opening WMI ports; the device runs on a network segment (DMZ, isolated VPC) with strict outbound rules; or log volume from a source is high enough that endpoint-side buffering matters.
Use agentless when: the device is on the same LAN as the collector; WMI or RPC ports are open; the endpoint is locked down for a reason (regulated appliance, third-party managed system) and adding software isn't permitted; or the operations team wants zero endpoint-side maintenance.
Mixing modes is normal. A typical deployment runs agentless for the office LAN and agent-based for branch offices, DMZ hosts, and cloud workloads.
Frequently asked questions
A log collection agent is a software component installed on a host machine that captures logs locally and forwards them to a central log management platform in real time. Agents are what enable log collection across WAN links, through firewalls, and in segmented networks where agentless approaches can't reach.
Agent-based collection puts a piece of software on the source host; the host itself does the forwarding. Agentless collection puts nothing on the host—the central server reaches out and pulls the logs over standard protocols like WMI or SSH. Agents are for network-constrained environments; agentless is for well-connected LANs. EventLog Analyzer supports both simultaneously.
Windows servers and workstations for event log collection; Linux and Unix hosts for syslog and Journald; and any device or application that writes to a local file the agent can read. Network devices (routers, switches, and firewalls) that emit syslog natively are usually collected without an agent by forwarding syslog directly to the server.
Yes—that's the primary use case. The agent initiates outbound connections to the collector on a single configurable port, which is significantly easier to permit through a firewall than the multiple ports WMI or RPC would require inbound. For WAN links, the agent buffers locally, so brief network interruptions don't drop events.
