Real-Time Event Log Viewer
View Windows event logs in real-time using the WMI protocol with the Real-Time Event Log Viewer (RTEV). Event logs can be filtered by log type, event source, and the level of severity.
The viewer allows you to:
- Start monitoring selected real-time Windows event log entries
- Pause and restart polling
- Log into the selected server with different credentials
You may need to log in with an administrator account to perform this action.
Access the Real-Time Event Log Viewer
- Click My Dashboards > Applications > SAM Summary.
- Select an application from the All Applications widget.
Select Real-Time Event Log Viewer from the Management widget.
The Real-Time Event Log Viewer opens with a filterable list of all events and logs.
Pop-ups must be enabled for the RTEV to be viewed.
Filter Real-Time Events
After the events of the selected Log Type are collected and appear in the window on the right, you can filter the results with various criteria.
Select an option from the log type drop-down menu:
Select Custom Sources from the Event Sources drop-down menu. Select only the sources you want to keep when the filter is applied, as highlighted:
Select the type of messages you want the filter to keep by selecting the Event Level.
- Click Apply Filter to have the events filtered and displayed.
After filtering is complete, hide and unhide the filtering pane on the left by clicking either of the two arrows, highlighted in red:
The display window shows a list of the most recent events. Should any new events occur while this window is open, a green bar at the top of the window indicates that new events have arrived. Click the green bar to add these new events to the display window.
The Level column icons correspond to the Event Level icons in the legend of the events pane.
Clicking any message in the display window brings up a message box providing the entire message along with additional details.
You can monitor selected events from the Real-Time Event Log Viewer by selecting an event and creating a component monitor:
Select an event and click Start Monitoring in the Message Details view.
The Add Component Monitor wizard opens with the selection.
Modify the Component Monitor based on the application you selected, following the wizard steps.
After you begin the Component Monitor Wizard, use the option to Disable Keyword Matching. The Include Events drop-down menu provides options to help you filter results.
- Save and assign the component monitor.