Event Log Blog

I'm excited to announce that we released updates to both the iPhone as well as Android version of our mobile app, and both updates are now available in the Apple App Store and Google Play Store respectively.

The iOS version now supports the larger iPhone 5 display as well as a variety of improvements in regards to load speed, rotation and so forth.

The Android version catches up with the iOS version, adding the heartbeat page and fixing an issue where the app would not launch on devices running Jelly Bean. We've also beautified the app a bit and donated some color icons to the menu. Yes, the Android app now has officially more color than the iOS version. How crazy is that?

We also had to change how EventSentry Mobile is distributed through the Google Play Store, where our mobile app is now called "EventSentry Mobile" (instead of just "EventSentry"). Existing users of the mobile app will, unfortunately, need to uninstall and re-install the app to get the latest version. This was necessary due to Google's policies and a mishap on our part. Future releases of the Android app will support updating however, and we apologize for the inconvenience.

To get the free update, either search for "EventSentry" on your mobile device, or visit the links below.

Google Play: https://play.google.com/store/apps/details?id=net.netikus.eventsentry.mobile

iTunes: https://itunes.apple.com/us/app/eventsentry/id440535744

Now, if you use or like the app - why not rate it and write a short review?

Thanks,

your NETIKUS.NET team.

Automatic Windows Updates are a wonderful thing when they are working as expected, and many organizations employ WSUS or patch management software to keep their infrastructure up to date with the latest Microsoft hot fixes and service packs.

While this works for many, not everybody can afford patch management software, and, while free, managing the disk-hungry WSUS can be a daunting task as well. This leaves some sysadmins to use the old-fashioned Windows Updates to install all the regular and out-of-band patches Microsoft releases.

If you don't feel comfortable installing patches automatically however, configuring Windows Update to "download updates for later manual installation" is often safer and more predictable. But, if you're not logging on to the server(s), you won't know whether one or more updates are ready for installation or not. Even if you're just managing one server, checking in on a regular basis can be a waste of time.

This is where EventSentry and its log file monitoring feature comes in. It turns out that Windows, like a diligent ship captain, logs all activity to a log file. And with all, I really do mean ALL. The file I'm talking about is windowsupdate.log, and it tells you just about everything that's going on with Windows Update. In 3-4 steps that don't take longer than 5 minutes, you can setup real-time monitoring of the WindowsUpdate.log file, and be notified when updates are about to be downloaded to a monitored computer.

The screenshot below shows what such an email from EventSentry would look like:

From then on, you can either get email notifications when patches are downloaded, or use the web-based reporting to view a report from all of your monitored hosts. On a high level, the configuration works like this:

1. Setup a log file (%systemroot%\windowsupdate.log in this case)

2. Create & assign a new log file package

3. Define a log file filter (this tells EventSentry what to look for in the file, and where to send it)

4. Setup an email action (this is usually already setup)

5. Optionally setup an event log filter to forward alerts to email (the default filter setup should automatically forward warnings)

The WindowsUpdate.log is useful for troubleshooting as well, and you can consolidate the content of this file from all of your servers in the central EventSentry database. This makes searching for text and/or comparing the log from multiple servers a breeze. Having the log file accessible through the web reports is also useful when a patch caused problems and the server is offline. You can view the most recent activity from the log file through the web-based reporting even when the server is unavailable.

So how do you set this up? Assuming you have EventSentry v2.93 installed (any edition will do, including the free "light" version), you can follow the steps outlined below. Note that all steps will need to be performed in the EventSentry management console.

1. Setup a file definition. This tells EventSentry which file you want to monitor, and sets up a logical representation of that file in the EventSentry configuration. In the "Tools" menu, click "Log Files and File Types" and then click the "Add" button.

2. Create a package and add a filter. Right-click the "Log File Packages" container, select  "Add Package" and choose a descriptive name. Since new packages are unassigned by default, right-click the newly created package, select "Assign" and assign the package to host(s) on which you want to monitor the Windowsupdate log file.

3. Setup a log file filter. This tells EventSentry which content of the monitored file you are interested in. In every log file filter you can configure a database as well as an event log filter. 

Right-click the previously created package and select "Add File". From the list, select the log file definition created in step 1, "WindowsUpdateLog". Select the new log file.

The database tab determines which content goes to the database (in most cases you will write all file contents to the database), while the event log tab determines which log file contents are written to the event log. For this project, we are interested in the following wildcard matches:

The first wildcard match will tell you the total number of updates which have been approved and will be downloaded, whereas the 2nd line will fire for every individual update which will be downloaded. In most cases the first line is sufficient and the 2nd line can be skipped.

That's it! With this setup, you will immediately get notified when patches are ready to be installed. The only thing I didn't mention here is how to setup an email action and corresponding event log filter, since both of these are usually already setup by default. If you need help with this, please check out our documentation and/or tutorials.

As always, happy monitoring!

We're excited to announce a new version of our free server and log monitoring solution EventSentry, EventSentry Light. EventSentry Light is:

To see all the new features which were added to full release EventSentry v2.93.1, see "EventSentry v2.93.1 - Part 1" and "EventSentry v2.93.1 - Part 2".

In addition to the new features and bug fixes of the 2.93.1 release, we also decided to make the latest version of EventSentry Light even more useful for sysadmins by enabling several features which were previously only available in the full version:

In addition to the above new functionality, we also increased many of the existing limitations:

EventSentry Light v2.93.1 is a significant upgrade from v2.92, with many new features now available to light users. Remember, with EventSentry Light you can:

• monitor event logs
• monitor log files
• monitor remote hosts
• receive syslog & snmp data
• monitor and control services
• monitor disk space
• monitor file checksums
• monitor performance
• monitor & set the system time
• schedule and monitor scripts
• monitor temperature with optional sensors

So if you're running EventSentry Light v2.92 or older then the time to upgrade is now! If you're not using EventSentry at all, then the time to install it is now - you have nothing to loose.