Application Event Log Test
This test reports the statistical information about the application events generated by the target system.
Target of the test : Unix/ Windows Server
Agent deploying the test :
Outputs of the test : One set of results for the filter configured
|
Measurement | Description | Measurement Unit | Interpretation |
---|---|---|---|
Application errors: |
This refers to the number of application error events that were generated. |
Number |
A very low value (zero) indicates that the system is in a healthy state and all applications are running smoothly without any potential problems. An increasing trend or high value indicates the existence of problems like loss of functionality or data in one or more applications. Please check the Application Logs in the Event Log Viewer for more details. |
Application information count: |
This refers to the number of application information events generated when the test was last executed. |
Number |
A change in the value of this measure may indicate infrequent but successful operations performed by one or more applications. Please check the Application Logs in the Event Log Viewer for more details. |
Application warnings: |
This refers to the number of warnings that were generated when the test was last executed. |
Number |
A high value of this measure indicates application problems that may not have an immediate impact, but may cause future problems in one or more applications. Please check the Application Logs in the Event Log Viewer for more details. |
Application critical errors: |
Indicates the number of critical events that were generated when the test was last executed. |
Number |
A critical event is one that an application or a component cannot automatically recover from. This measure is applicable only for Windows 2008/Windows Vista/Windows 7 systems. A very low value (zero) indicates that the system is in a healthy state and all applications are running smoothly without any potential problems. An increasing trend or high value indicates the existence of fatal/irrepairable problems in one or more applications. The detailed diagnosis of this measure describes all the critical application events that were generated during the last measurement period. Please check the Application Logs in the Event Log Viewer for more details. |
Application verbose: |
Indicates the number of verbose events that were generated when the test was last executed. |
Number |
Verbose logging provides more details in the log entry, which will enable you to troubleshoot issues better. This measure is applicable only for Windows 2008/Windows Vista/Windows 7 systems. The detailed diagnosis of this measure describes all the verbose events that were generated during the last measurement period. Please check the Application Logs in the Event Log Viewer for more details. |
The filter policy for the ApplicationEventLog test, ApplicationEvents test, SystemEvents test, and SystemEventLog test typically comprises of a specific set of event sources, event IDs, and event descriptions to be monitored. This specification is expressed by the eG Enterprise system in the following format:
{Policyname}:{event_sources_to_be_included}:{event_sources_to_be_excluded}:{event_IDs_to_be_included}:{event_IDs_to_be_excluded}:{event_descriptions_to_be_included}:{event_descriptions_to_be_excluded}
On the other hand, the filter policy for the SecurityLog test comprises of a specific set of event sources, event ids, and users to be monitored. This specification is expressed by the eG Enterprise system in the following format:
{Policyname}:{event_sources_to_be_included}:{event_sources_to_be_excluded}:{event_IDs_to_be_included}:{event_IDs_to_be_excluded}:{users_to_be_included}:{users_to_be_excluded}
To add a new policy, do the following:
-
Click on the Click here hyperlink available just above the test configuration of the ApplicationEventLog test, ApplicationEvents test, SystemEvents test, SystemEventLog test, or SecurityLog test (see Figure 1).
Figure 1 : Figure 3. 29: Configuring an ApplicationEvents test
-
Figure 2 will then appear listing the policies that pre-exist.
- To view the contents of a policy, click on the View button against the policy name. While a policy can be modified by clicking on the Modify button, it can be deleted using the Delete button. The default policy is all, which can only be viewed and not modified or deleted. The specification contained within this policy is: all:none:all:none:all:none.
-
To create a new policy, click on the Add New Policy button in Figure 2. Doing so invokes Figure 3, using which a new policy can be created.
- In Figure 3, first, provide a unique name against POLICY NAME.
-
To include one/more event sources for monitoring, select Included from the EVENT SOURCES drop-down list, and then specify a comma-separated list of event sources in the adjacent text box. If you require more space to specify the event sources, click on the View button next to the text box. This will invoke an EVENT SOURCES INCLUDED text area (see Figure 4), wherein the specification can be provided more clearly and comfortably.
-
To exclude specific event sources from monitoring, select Excluded from the EVENT SOURCES drop-down list, and then specify a comma-separated list of event sources to be excluded in the adjacent text box. If you require more space to specify the event sources, click on the View button next to the text box. This will invoke an EVENT SOURCES EXCLUDED text area, wherein the specification can be provided more clearly and comfortably.
Note:
At any given point in time, you can choose to either Include or Exclude event sources, but you cannot do both. If you have chosen to include event sources, then the eG Enterprise system automatically assumes that no event sources need be excluded. Accordingly, the {event_sources_to_be_excluded} section of the filter format mentioned above, will assume the value none. Similarly, if you have chosen to exclude specific event sources from monitoring, then the {event_sources_to_be_included} section of the format above will automatically take the value all, indicating that all event sources except the ones explicitly excluded, will be included for monitoring.
- In the same way, select Included from the EVENT IDS list and then, provide a comma-separated list of event IDs to be monitored. For more space, click on the View button next to the text box, so that an EVENT IDS INCLUDED text area appears.
-
If you, on the other hand, want to exclude specific event IDs from monitoring, then first select Excluded from the EVENT IDS list box, and then provide a comma-separated list of event IDs to be excluded. For more space, click on the View button next to the text box, so that an EVENT IDS EXCLUDED text area appears.
Note:
At any given point in time, you can choose to either Include or Exclude event IDs, but you cannot do both. If you have chosen to include event IDs, then the eG Enterprise system automatically assumes that no event IDs need be excluded. Accordingly, the {event_IDs_to_be_excluded} section of the filter format mentioned above, will assume the value none. Similarly, if you have chosen to exclude specific event IDs from monitoring, then the {event_IDs_to_be_included} section of the format above will automatically take the value all, indicating that all event IDs except the ones explicitly excluded, will be included for monitoring.
- Likewise, select Included from the EVENT DESCRIPTIONS list and then, provide a comma-separated list of event descriptions to be monitored. For more space, click on the View button next to the text box, so that an EVENT DESCRIPTIONS INCLUDED text area appears.
-
For excluding specific event descriptions from monitoring, first select Excluded from the EVENT DESCRIPTIONS list box, and then provide a comma-separated list of event descriptions to be excluded. For more space, click on the View button next to the text box, so that an EVENT DESCRIPTIONS EXCLUDED text area appears.
Note:
Instead of the complete event descriptions, wild card-embedded event description patterns can be provided as a comma-separated list in the Included or Excluded text boxes. For instance, to include all events that start with st and vi, your Included specification should be: st*,vi*. Similarly, to exclude all events with descriptions ending with ed and le, your Excluded specification should be: *ed,*le.
-
In case of the SecurityLog test however, you will not be required to include/exclude event descriptions. Instead, an event users field will appear, using which you need to configure users who need to be included/excluded from monitoring.
Note:
At any given point in time, you can choose to either Include or Exclude event descriptions/users, but you cannot do both. If you have chosen to include event descriptions/users, then the eG Enterprise system automatically assumes that no event descriptions/users need be excluded. Accordingly, the {event_descriptions_to_be_excluded} section or the {users_to_be_excluded} section (as the case may be) of the filter formats mentioned above, will assume the value none. Similarly, if you have chosen to exclude specific event descriptions/users from monitoring, then the {event_descriptions_to_be_included} section or the {users_to_be_included} section (as the case may be) of the formats above will automatically take the value all. This indicates that all event descriptions/users except the ones explicitly excluded, will be included for monitoring.
- Finally, click the Update button.
-
The results of the configuration will then be displayed as depicted by Figure 5.
Figure 5 : Results of the configuration
Note:
If you have configured a policy to Include a few/all events (sources/IDs/descriptions/users), and Exclude none, then, while reconfiguring that policy, you will find that the Include option is chosen by default from the corresponding drop-down list in Figure 2. On the other hand, if you have configured a policy to to Exclude a few specific events and Include all events, then, while modifying that policy, you will find the Exclude option being the default selection in the corresponding drop-down list in Figure 2.