Oscar Segarra
2012-02-16 09:07:41 UTC
Oscar Segarra [http://community.zenoss.org/people/Oscar] created the discussion
"Re: What is the zWinEventlogClause property?"
To view the discussion, visit: http://community.zenoss.org/message/64547#64547
--------------------------------------------------------------
Hi.
There are three parameters that affect windows Eventlog monitoring feature:
zWinEventLog: true/false
zWinEventLogClause: +I will explain it below+
zWinEventLogMinSecurity: <<look at http://community.zenoss.org/thread/4896?start=0&tstart=0 http://community.zenoss.org/thread/4896?start=0&tstart=0>>
#
Internally Zenoss executes the following WMI query when zWinEventlog is set to "true":
SELECT * FROM __InstanceCreationEvent
WHERE TargetInstance ISA 'Win32_NTLogEvent'
AND TargetInstance.EventType <= +zWinEventLogMinSecurity+
AND +zWinEventLogClause+
 
Win32_NTLogEvent is defined as follows ( http://msdn.microsoft.com/en-us/library/windows/desktop/aa394226(v=vs.85).aspx http://msdn.microsoft.com/en-us/library/windows/desktop/aa394226(v=vs.85).aspx):
class Win32_NTLogEvent
{
 uint16  Category;
 string  CategoryString;
 string  ComputerName;
 uint8   Data[];
 uint16  EventCode;
 uint32  EventIdentifier;
 uint8   EventType;
 string  InsertionStrings[];
 string  Logfile;
 string  Message;
 uint32  RecordNumber;
 string  SourceName;
 datetime TimeGenerated;
 datetime TimeWritten;
 string  Type;
 string  User;
};
You can use any of the previous fields.
If we wish to detect/monitor events having event_id 1111 or 3364 at eventlog, we must set zWinEventLogClause parameter to (TargetInstance.EventIdentifier=1111 OR TargetInstance.EventIdentifier=3364).
System will execute the following working query:
SELECT * FROM __InstanceCreationEvent
WHERE TargetInstance ISA 'Win32_NTLogEvent'
AND TargetInstance.EventType <= +2+
AND (TargetInstance.EventIdentifier=1111 OR TargetInstance.EventIdentifier=3364);

I hope this helps.
--------------------------------------------------------------
Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64547#64547]
Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]
"Re: What is the zWinEventlogClause property?"
To view the discussion, visit: http://community.zenoss.org/message/64547#64547
--------------------------------------------------------------
Hi.
There are three parameters that affect windows Eventlog monitoring feature:
zWinEventLog: true/false
zWinEventLogClause: +I will explain it below+
zWinEventLogMinSecurity: <<look at http://community.zenoss.org/thread/4896?start=0&tstart=0 http://community.zenoss.org/thread/4896?start=0&tstart=0>>
#
Internally Zenoss executes the following WMI query when zWinEventlog is set to "true":
SELECT * FROM __InstanceCreationEvent
WHERE TargetInstance ISA 'Win32_NTLogEvent'
AND TargetInstance.EventType <= +zWinEventLogMinSecurity+
AND +zWinEventLogClause+
 
Win32_NTLogEvent is defined as follows ( http://msdn.microsoft.com/en-us/library/windows/desktop/aa394226(v=vs.85).aspx http://msdn.microsoft.com/en-us/library/windows/desktop/aa394226(v=vs.85).aspx):
class Win32_NTLogEvent
{
 uint16  Category;
 string  CategoryString;
 string  ComputerName;
 uint8   Data[];
 uint16  EventCode;
 uint32  EventIdentifier;
 uint8   EventType;
 string  InsertionStrings[];
 string  Logfile;
 string  Message;
 uint32  RecordNumber;
 string  SourceName;
 datetime TimeGenerated;
 datetime TimeWritten;
 string  Type;
 string  User;
};
You can use any of the previous fields.
If we wish to detect/monitor events having event_id 1111 or 3364 at eventlog, we must set zWinEventLogClause parameter to (TargetInstance.EventIdentifier=1111 OR TargetInstance.EventIdentifier=3364).
System will execute the following working query:
SELECT * FROM __InstanceCreationEvent
WHERE TargetInstance ISA 'Win32_NTLogEvent'
AND TargetInstance.EventType <= +2+
AND (TargetInstance.EventIdentifier=1111 OR TargetInstance.EventIdentifier=3364);

I hope this helps.
--------------------------------------------------------------
Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/64547#64547]
Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]