The Event Streamer module allows streaming of events from any event log installed on the system. Initially, when the module is installed, it consists of a default set of event logs and event IDs to collect information from and stream to the destination server. The module's configuration policy page displays all the event logs.
The Event Log Streaming page displays all the event logs installed on the system. Here, you can enable/disable the event log by selecting the checkbox from the Enabled column. This will just disable the event log from showing up in the list and does not delete the entry. If you want to remove the entry of the event log from the list, click the delete icon. Also, if you want to change the details of event IDs, click the edit icon.
.png "Event_Log1.png")
To add a custom event log:
Click the ADD EVENTLOG button.
The Add EventLog dialog box is displayed.
.png "Add_eventlog.png")
Enter the following details for the event log:
Display Name: Though, this is not a mandatory field, it helps to identify the event log.
Event Source: The full name of the event log as listed in the Event Viewer application.
Note
Use the Windows Event Log viewer application (eventvwr.msc) to find the correct value of the event source.
Select the eventlog, right-click and then select Properties.
In the Log Properties dialog box, the value listed in the “Full Name” field is the correct value of the event source.
Event IDs: A comma delimited list of IDs to be monitored.
Note
Event ID ranges can be specified in the specific event log configuration entry using the notation [<start id> - <end id>], inclusive.
Click Save.
Example
The example provides a clear understanding on how to add events to be monitored by Event Streamer. Here, Sysmon event log is added using the Add EventLog page.
Display Name: The display name is any name that helps identify this entry, for example, System Monitor (Sysmon).
Event Source: Enter the following value Microsoft-Windows-Sysmon/Operational.
Event IDs: Enter any event IDs you like to monitor.