Managing events in SEM Monitor view

This topic describes how to work with events in Monitor view.

Events are messages created from Agent, Manager, and network device log entries. These log entries are processed (or normalized) to extract information and display the data in a common table format instead of the often-convoluted format you see in the source data. Monitor view displays all monitored events on your network in real time. It includes features to help you review and analyze current events on your network. The normalized events are sent from the Agent to the Manager for processing. At the Manager, the events are processed against your rules, sent to the database for archiving, and sent to the SEM console for monitoring.

When you click a filter in the Filters pane, inbound traffic is channeled through the filter and displayed in the events pane. You can pause the incoming event stream, sort and highlight the data, and respond to events with a corrective action. When completed, you can resume the incoming traffic that appears in the events grid.

Click the video icon to learn how to use SEM to view all real-time and historical activity from a single IP address.

Review an event

  1. Open the SEM console. See Log in to the SEM web console for steps.

  2. On the SEM toolbar, click Monitor.
  3. In the Filters pane, select a filter.

  4. Locate an event in the event grid you want to explore.

  5. To stop the event feed, click Pause.

  6. Select the event in the grid.

  7. From the Explore drop-down list, select Event.

    The Event explorer displays all events associated with your selected event. Your selected event name displays in the History pane.

    To view additional event information, click Event Details.

To apply a filter to the Monitor event stream

  1. Open the SEM console. See Log in to the SEM web console for steps.

  2. On the SEM toolbar, click Monitor.
  3. To open the Filters sidebar, click Filters in the upper-left corner.

  4. Expand a filter category and select a default or custom filter from the Filters list.

    The events grid title bar displays the name of your selected filter, and the grid refreshed to display incoming events that match the conditions of your filter.

SEM saves event filters on the workstation running the SEM console. If you move to another workstation, you can export the filters to your new workstation and import them into the console.

To view the event details for a specific event in the event stream

  1. Apply a filter to the Monitor event stream (as described above).

  2. Select the event in the event stream and review the results in the Event Details pane.

Change the widget display for a selected filter

  1. Open the SEM console. See Log in to the SEM web console for steps.

  2. On the SEM toolbar, click Monitor.
  3. In the Filters pane, maximize a category, and then click the filter you want to modify.

  4. In the Widgets pane, click the drop-down list, and then select the widget you want your filter to display.

To edit a widget chart presentation in Monitor view

Widgets displayed in Monitor view allow you to reconfigure the chart settings to suit your needs. These settings include the visualization type (line, bar, pie, or table), the color palette, and the X and Y axis labels.

  1. Open the SEM console. See Log in to the SEM web console for steps.

  2. On the SEM toolbar, click Monitor.

  3. In the Monitor dashboard, locate the widget you want to reconfigure.

  4. On the widget toolbar, click .

    The widget rotates the interface to display the presentation format settings.

  5. Reconfigure the widget settings as required.

    Your options are limited to the selected widget and the data it reports. For example, widgets that report in one dimension may be limited to a pie chart, while information in two dimensions can be reported in a bar or line chart.

  6. Click to close.

    The widget rotates, displaying the information in your chosen format.

Sort the events grid

You can sort the events in the events grid by clicking the appropriate column header. For example, if you click the Event Name column header, the grid sorts the filtered events by event name in ascending order. If you click the column header again, the events are sorted in descending order.

  1. On the events grid toolbar, click Pause.

  2. To sort your filtered events, click the appropriate column header.

  3. When completed, click Resume to continue receiving filtered traffic.

Highlight events

In the Monitor view events grid, you can highlight events to call attention to them or mark them for future reference. This allows the events to stand out as you scroll through the contents of the grid. You can highlight multiple events at the same time. You can also choose the color you want for each set of events you are highlighting.

  1. Open the SEM console. See Log in to the SEM web console for steps.

  2. On the SEM toolbar, click Monitor.
  3. In the Filters pane, select a filter from a filter group.

  4. To temporarily stop all incoming events, click Pause on the events toolbar.

    Pausing incoming events is not required, but it places all events in static mode for review.

  5. In the events grid, click the events you want to highlight.

    To select two or more events, press <Ctrl>.

  6. On the events grid toolbar, click to highlight a row with selected color or enter hexadecimal value.

    The events appear in your selected color.

  7. To resume the incoming web traffic, click Resume.

Disable highlighted events

  1. To temporarily stop all incoming events, click Pause on the events grid toolbar.
  2. In the events grid, select the appropriate events to disable the highlight.

    To select multiple events, press <Ctrl>.

  3. On the events grid toolbar, click the drop-down list, and then select No Color.

  4. To resume all incoming events, click Resume.

Copy event data to the clipboard

Copy event data for single or multiple events from the Monitor view events grid or Event Details pane to your clipboard. This allows you to paste the data into another application (such as Microsoft Excel for comparison or analysis), share the data with someone who does not have a console, or send to SolarWinds for technical support.

  1. Open the SEM console. See Log in to the SEM web console for steps.

    Click Monitor.

  2. In the Filters pane, select a filter from a filter group.

  3. In the events grid, select the event you want to copy.

    To select two or more events, press <Ctrl>.

  4. In the events grid, click , and then select Copy.

    The event data is now copied to your clipboard (as text).

Tag events as Read or Unread

You can mark events in event filter as unread and read. This process allows you to track examined and unexamined events.

  1. Open the SEM console. See Log in to the SEM web console for steps.

    Click Monitor.

  2. In the Filters pane, select a filter from a filter group.

    The events grid displays your selected filter.

  3. In the events grid, select the events you want to mark as read or unread.

  4. To select two or more events, press <Ctrl>.

  5. In the events grid, click , and then select one of the following options:

    • Mark Unread identifies one or more selected events as unread in bold text. Any events captured by other filters appear as unread in those filters as well.

    • Mark Read identifies one or more selected events as read in non-bold text.

    • Mark All Unread identifies all events as read in bold text.

    • Mark All Read identifies all events as read in non-bold text.

    The grid refreshes based on your selection.

Remove events

You can remove one or all events from a filter. This allows you to clean a filter of historical information that is no longer important.

  1. Open the SEM console. See Log in to the SEM web console for steps.

  2. On the SEM toolbar, click Monitor.
  3. In the Filters pane, select a filter from a filter group.

  4. In the events grid, select the events you want to remove.

    To select two or more events, press <Ctrl>.

  5. In the events grid, click , and then select Remove.

    Select Remove All to remove all events.

    The selected events are removed from the grid.