Table of Contents
- Getting Started
- Agent-Based Monitoring
- Data Providers
- Directory Services
- Auditing
- Hosts
- Templates
- Template Properties
- Batch Update Templates
- Log Management Templates
- File and Directory Monitor Templates
- Windows Monitor Templates
- Account Lockout Monitor Template
- Logon Monitor Template
- CPU Monitor Template
- Memory Monitor Template
- Disk Space Monitor Template
- SMART Monitor Template
- Windows Update Template
- Process Monitor Template
- Service Monitor Template
- Performance Counter Monitor Template
- PowerShell Template
- Registry Value Monitor Template
- Active Directory User Monitor Template
- Active Directory User Integrity Monitor Template
- Task Scheduler Template
- Clock Synchronization Template
- Defragment NTFS Disks Template
- Network and Application Monitor Templates
- Database Monitor Template
- Directory Service Monitor Template
- DNS Blacklist Monitor Template
- DNS Monitor Template
- Domain Expiration Monitor Template
- Network Speed Monitor Template
- Ping Monitor Template
- Database Table Reseed
- SQL Server Shrink and Backup Template
- SSH Shell
- TCP Port Scan Monitor Template
- Website Monitor Template
- SSL Certificate Monitor Templates
- Email Monitor Templates
- SNMP Monitor Templates
- Monitors
- Reports
- Auto-Configurators
- Filters
- Actions
- Desktop Actions
- Email Actions
- Event Log Actions
- Executable Actions
- File Actions
- IIS IP Address Restriction Actions
- Microsoft Teams Actions
- PowerShell Actions
- Report Actions
- Service Actions
- SMS Actions
- SNMP Trap Actions
- Syslog Actions
- Template Actions
- IIS IP Address Restriction Actions
- Action Variables
- Schedules
- Environment Variables
- Options
- Account Lockout Monitoring and Reporting
- Merging Logs
- SNMP
- SSH Shell
- Syslog
- Exporting and Importing Configuration Objects
- Shared Views
- Auto-Config Host Assignment Properties
- General Executable Properties
- Assign Actions
- Assign Directories
- Assign Disks
- Assign Shares
- Assign Files
- Assign Consolidated Logs
- Assign Event Logs
- Assign Azure Audit Logs
- Target Files and Sub-Directories
- Define Log Entry Columns
- Define Log Entry Columns with Regular Expressions
- Define CSV and W3C Log Entry Columns
- Active Directory User and Group Filters
- Explicitly Assigned Logs
- File Explorer
- Report Columns
- Report Date/Time Ranges
- Report Security Event Log Filters
- Select Folder or File
- Executable Timeline
- Command Line Interface
- Troubleshooting
- Terminology
Event Log Consolidation Template
Event Log consolidation is the process of downloading Event Log entries and saving them to a Data Provider, also known as a Log Database.
There are two methods which Event Log entries can be saved to the Log Database.
- Microsoft's WMI
- Corner Bowl's Server Manager Agent
WMI is Microsoft's premier technology for remote management often plagued with errors such as RPC_E_DISCONNECTED, RPC_E_CALL_CANCELED, The remote procedure call failed, Quota violation and many others. The upside to using WMI is it works, well mostly, out-of-the-box. The Corner Bowl Server Manager Agent resolves these issues by providing reliable Event Log entry transfers that complete approximately 12x faster than WMI. The downside to using the agent is that is must be installed on each managed server.
Using WMI
Server Manager comes pre-installed with a Event Log Consolidation template that downloads the Application, Security and System Event Logs. You have the option of extending this template or creating your own.
How to Configure WMI-Based Event Log Consolidation
- From the Explorer View, expand Templates | Sample Templates | Log Consolidation then right click on Event Log Consolidation and select Template Properties.
- The Template Properties view contains 7 tabs.
![]() |
By default this template downloads entries every hour and evenly distributes each download over the hour among the assigned hosts. For example, if you assign 60 hosts to this template the software will download entries form a single and different server every minute. After 60 minutes the first server will be downloaded again. |
The Options Tab
- Optionally assign a Consolidation filter to dump entries you do not want saved to the Log Database. When assigned, only entries that pass the assigned consolidation filter are saved to the Log Database.
-
Use the Initial number of days to download to configure the initial download. Subsequent downloads always pull from the last saved entry forward.
If you have a heavily loaded domain controller you may need to limit the initial download of the Security Event Log to one day then build the database from that point on, otherwise you may receive a Quota Violation. You also have the option of specifying 0 days. When set to 0, Server Manager downloads the last hour of entries which should resolve any Quote Violation errors. -
Use the Download in batches of option to minimize WMI results sizes. This option is yet another attempt to work around Quota Violation errors.
If you are unable to resolve Quota Violation errors using the hourly batch method increase the Windows host's WMI Quota. For more information see: WMI Properties. - Use the Clear the remote Event Log after each download to clear the actual Event Log from managed hosts once the download is complete.
-
When configuring a Microsoft Application Log, use the Enable WMI API checkbox to access the log using WMI rather than the .Net EventLogSession API.
When this option is set, several required Windows Registry entries are added to the managed host prior to downloading. If this option is not set, each downloaded Event's message may not be properly display. - Use the Log Entry Retention Policy drop-down to select the retention policy. The retention policy is another template that defines the number of days to retain in the Primary and Archive Log Databases, for example, archive entries older than 30 days and retain entries for 150 days for a total of 180 days. Assign multiple retention policies to remove entries that match filter criteria defined in each retention policy. For more information see: Log Entry Retention Policy Template
Using the Agent
Server Manager comes pre-installed with an Agent-Based Event Log Consolidation template that requests managed servers to upload their Application, Security and System Event Logs. You have the option of extending this template or creating your own.
How to Configure Agent-Based Event Log Consolidation
For more information see: Agent Server