The Windows Log Monitor plugin allows you to monitor your windows logs based on the matching and frequency of certain specified occurrences. Event Log monitoring is based on C# regex syntax, you can read more about the syntax required to monitor event logs.

If you can not add this plugin in the Windows Add metric list, then your version of the Agent is out of date and you should update it to gain access to this feature.

If you haven't read Add FortiMonitor Agent checks, start there.

Control Panel Configuration

You can add a Windows Log Monitor check by clicking Add under the Windows metric section. Look for Windows Event Logs.

The check itself will hinge off a number of variables, which are listed with their options below:

Log type

• System

• Application

• Custom

• All

Log Severity

• Critical

• Warning

• Error

• Information

Log Source (optional)

• All Sources

• Application Popup

• Customer Experience Improvement

• EventLog

• Microsoft-Windows-CAPI2

• Microsoft-Windows-DHCPv6-Client

• Microsoft-Windows-DNS-Client

• Microsoft-Windows-Dchp-Client

• Microsoft-Windows-Diagnostics-Networking

• Microsoft-Windows-Eventlog

• Microsoft-Windows-FilterManager

• Microsoft-Windows-GroupPolicy

• Microsoft-Windows-lphlpsvc

• Microsoft-Windows-Kernel-General

• Microsoft-Windows-Kernel-Power

• Microsoft-Windows-Kernel-Processor-Power

• Microsoft-Windows-RestartManager

• Microsoft-Windows-Security-Auditing

• Microsoft-Windows-Time-Service

• Microsoft-Windows-UserPnp

• Microsoft-Windows-WindowsUpdateClient

• Microsoft-Windows-Winlogon

• MsiInstaller

• NetBT

• PowerShell

• Server

• Service Control Manager

• TermDD

• USER32

• WinRM

• Windows Error Reporting

• xennet6

Log Message Regex Filter (Optional)

Set the Time Frame (range from 1 minute-60 minutes in 10-minute increments)

Set the frequency of the monitor (how often will the metric be collected?)

You can also set the Alert Timeline the alerts will adhere to, and tag the Windows Log Monitor checks.

Custom logs

To add custom logs, perform the following steps:

1. From the Monitoring Config tab of the instance click Add Monitoring > Windows > Windows Event Log.

2. For the Log Type, select Custom.

3. Fill in the other fields as shown in the following example. In this example, the Windows Event Viewer is used as a reference.

4. Set the Time Frame and Frequency based on your needs and the average period between events.

If you have any questions about how to properly configure this check, please contact our support team.