Documentation forSecurity Event Manager

Run a SEM report on-demand or schedule a SEM report to run later

This section describes how to run a SEM report on-demand, as well as schedule reports to run automatically. This section also documents how to run the default SEM Batch Reports using Windows Task Scheduler.

Run an on-demand report in the SEM reports application

  1. Open the SEM reports application. See Open the SEM reports application for steps.

  2. On the Settings tab, click the Data Source drop-down menu and select a SEM Manager instance (the IP address or hostname of your SEM VM).

  3. From the Category drop-down list, select a report category filter—for example, Audit (Optional).

  4. Select a report title, and then click Run in the toolbar.

  5. Select your start and end date and time parameters, and then click OK.

    The report appears in the View tab.

    This process may take several minutes to complete.

  6. To send the report to a local or network printer, click Print.

  7. To export the report to the appropriate format (such as a PDF or a Microsoft Word document), click Export.

Create a scheduled report in the SEM reports application

The following list provide an overview of the report scheduling process. Each step is described in greater detail in the subsections that follow.

  1. Open the SEM reports application. See Open the SEM reports application for steps.

  2. Select the report that you want to schedule, and then click Schedule.

  3. Name the scheduled task to distinguish it from other similar tasks.

  4. Set the schedule parameters.

    This states when the scheduled report runs.

  5. Apply any advanced scheduling options.

  6. Define when the system can and cannot run the task.

  7. Apply the scheduled report to the data source (Manager) for which you want a report. Then define the scope, which is the period you want to the report to cover.

    When the system runs the report, it retrieves any pertinent events that occurred within the period defined by the scope.

  8. Select any export options for the report.

    This allows you to export to the folder of your choice, and in a format that is easy to read and print. If you do not export the report, it will automatically print to your default printer.

Repeat this process for each report you want to schedule.

You can create more than one schedule for the same report. This allows you to run the same report on different SEM Managers or run the same report in different intervals (such as daily, weekly, or monthly), each with a different scope.

Step 1: Selecting the report you want to schedule

In this step, you will select the report you want to schedule, and then open the Report Scheduler Tasks dialog.

  1. Open the SEM reports application. See Open the SEM reports application for steps.

  2. On the Settings tab, click the Category drop-down menu and select a report category

    The report list displays all saved reports in the category.

  3. In the Report Title column, locate the report you want to schedule.

  4. Right-click the report, and then select Schedule Report.

    The Report Scheduler Tasks dialog appears.

    The Event Summary box only displays the tasks that apply to your selected report.

  5. Add, edit, and delete your scheduled report tasks.

Step 2: Add a new scheduled report task

Name and configure the new scheduled task associated with this report.

  1. In the Reports Scheduler Tasks dialog, click Add.

  2. Enter a name for the report, and then click OK.

    The task scheduler form appears.

  3. Verify that the path in the Run field is correct. Click Browse and select the correct path, if required.

  4. Verify that the user name in the Run as field is correct.

    To change the user path, use the following format:


  5. To set up a password for the current user to run the report, click Set password.

  6. To run the scheduled task using the schedule you select in the Schedule tab, select the Enabled check box.

    To disable the schedule, clear the check box.

  7. To save your changes, click Apply.

  8. Complete the Task tab as described in the table.

  9. To save your changes, click Apply.

Step 3: Schedule the report

Create the report schedule. The settings on the Schedule tab tell the system when to run the report.

You can create multiple schedules for each report that is within the same scope. For example, you can run an event summary report for the current week and display the running total for the week at each hour. When completed, you can set the report to Week: Current and have multiple schedules that run on an hourly schedule and on a twice-daily schedule.

  1. Click the Schedule tab.

    For new tasks, the tab states that the task is not scheduled.

  2. To create a new report schedule, click New.

  3. Complete the Schedule tab selections.

  4. To save your changes, click Apply.

    The new report schedule appears in the list box near the top of the tab.

Step 4: Select the advanced scheduling options

If you clicked Advanced in the Schedule tab, the Advanced Schedule Options dialog box appears. You can schedule start and end dates for the report, or set a task to repeat for a set period of time.

  1. In the Schedule tab, click Advanced.

  2. Select the start and end dates.

  3. To start running repeated tasks, select the Repeat task check box.

  4. In the Until section, select the time or how long you want the task to run.

    By limiting the task run time, you can prevent the task from running continuously if a problem should occur.

  5. Select If the task is still running, stop it at this time to stop the system from running a report when the Time or Duration setting occurs. Clear this check box to have the system finish running a report that overlaps the Time or Duration setting.

    The following illustration displays the valid and invalid date formats for reports.

    In this example, the configured report runs every four hours, starting on Monday, August 18, and running through Sunday, August 30. Each time the task runs, the system will stop it if it continues to run for more than one hour.

  6. To save your changes and exit the form, click OK.

    You return to the task scheduler form.

Step 5: Stating when the system can or cannot run the task

Use the Settings tab to select when the system can and cannot run the task.

  1. Click the Settings tab.

  2. Complete the selections as required.

  3. To save your changes, click Apply.

  4. To close the task scheduler form and return to the Report Scheduler Tasks dialog, click OK.

Step 6: Assign the data source and scope

Assign the task to a particular data source (or Manager) and define the task scope (the period you want the report to cover). When the system runs the report, it retrieves any relevant events that occurred within the period defined by the scope.

  1. Select the report schedule you want to assign.

  2. Click Load to View or Edit.

    The Report Execution Settings For Selected Task section is enabled.

  3. Use this section to configure the report execution settings for the task (report schedule) you selected above.

  4. Use the Select the report data source list to select the Manager or to which you want to assign this task.

    You can only assign a task to a single Manager. If you need to assign a similar or identical task to a second Manager, create a new task.

Assign the task scope

In the Report Scope section, set up the task scope for this data source. The scope is the event period (or time frame) for the events you want the report to cover.

  1. From the Date Range drop-down list, select the date range you want the report to cover for this task and data source.

    In this example, the date range is Day: Today. The report will cover the period from 12:00:00 AM to 11:59:59 PM of the current date.

    If you select Week: Previous, the scheduled report will contain information from the last full week—from 12:00:00 AM the last Monday to 11:59:59 PM the last Sunday. For example, if today is Wednesday the 11th, the task runs from 12:00:00 AM on the 2nd to 11:59:59 PM on the 8th.

    Select one of the following date ranges:

    • Day: Today: Run for the specified time frame on the current (today’s) date.
    • Day: Yesterday: Run for the specified time frame on the previous (yesterday’s) date.
    • Week: Current: Run from one week ago to the current time.
    • Week: Previous: Run from 12:00:00 AM last Monday to at most 11:59:59 Sunday. This report will capture the last full week of data.
    • Month: Current: Run from one month ago to the current time.
    • Month: Previous: Run from 12:00:00 AM on the first of the month until 11:59:59 PM on the last day of the month. This will report will capture the last full month of data.
    • User Defined: Run another report scope. Use this option to schedule reports for arbitrary periods or periods that are outside of the conventional scope of a day, week, or month.
  2. Enter or select a start time and end time for reporting events that occurred on this Manager. The report will only show those events that occurred on the Manager within this period.

    If you select a week or month scope, you cannot edit the Start and End date and time fields.

  3. To configure the report so it automatically exports to a file, go to the next step. Otherwise, click Save.

    The Count Settings area only applies to count-based reports, such as Top 20 reports.

  4. In the Number of Items box, type or select the number of items you want the report to track.

Step 7: Export a scheduled report

You can enable the report utility to automatically export a scheduled report in PDF format to a specific folder. Otherwise, the system will send the report to your default printer.

  1. Open the Report Scheduler Tasks dialog.

  2. Select the scheduled report task you want to export in the Task Description box.

  3. Select the Export check box in the Report Settings tab to name and export this report when the task scheduler runs this report.

  4. From the Format drop-down list, select a file format for the exported report.

  5. Click the folder icon, locate the folder where you want to save the report, and a unique file name for the report.

    If the report has multiple schedules, give each scheduled report a different name. Otherwise, the exported file names files will overwrite each other or increment according to the If File Exists setting.

  6. In the If File Exists list, choose one of the following options:

    • Select Increment to store the new report along with any previous versions of the report in the folder. The reports application increments each report by appending the report file name with an underscore and a digit. For example, [FileName]_1.pdf.
    • Select Overwrite to have each new version of the report overwrite the previous version of the report in the folder.

  7. Click Save.

  8. Click Close to close the Report Scheduler Tasks dialog and return to the Reports dialog.

  9. Repeat Step 2: Adding a new scheduled report task through Step 7: Export a scheduled report for each report you want to schedule and assign to a particular data source.

Remove a report from the report scheduler

  1. Open the SEM reports application. See Open the SEM reports application for steps.

  2. Click the Settings tab.

  3. From the Category drop-down list, select Standard Reports or Custom Reports.

    The grid displays all reports in your selected category.

  4. In the Report Title column, click the name of the scheduled report for which you want to delete the task schedule.

  5. Click Schedule.

  6. In the Report Scheduler Tasks dialog, select the scheduled report in the Task Description list that includes the schedule you want to delete.

  7. Click Modify.

    The task schedule form appears.

  8. In the Task Schedule dialog, click the Schedule tab and select the Show Multiple Schedules check box.

  9. In the schedule list, select the schedule you want to delete, and then click Delete.

  10. To close the Report Scheduler Tasks form, click Close.

Configure Windows Task Scheduler to run the default SEM Batch Reports

The SEM reports application includes a default batch set of .ini files used to schedule reports. These files contain the configurations necessary to schedule several best-practice reports on either a daily or weekly basis, depending on the scope.

Prepare the INI file

Modify the default .ini files in the SEM reports installation directory to specify the hostname of the SEM Manager or SEM database in your environment, and the export destination for your scheduled reports.

To modify the default INI files:

  1. Navigate to the SEM Reports installation directory and open the SchedINI folder:
    • On 32-bit computers: C:\Program Files\SolarWinds Security Event Manager Reports
    • On 64-bit computers: C:\Program Files (x86)\SolarWinds Security Event Manager Reports
  2. Open each of the BRPT*.ini files and make the following changes in a text editor:
    • Replace the default value next to Manager1 with the hostname of the SEM Manager or database appliance in your environment. Use the hostname of your SEM database appliance if you have a dedicated appliance to store your normalized SEM alert data.
    • Modify the ExportDest file path if you want to customize the location to which SEM Reports saves the exported reports. The default file path is %ProgramFiles%\SolarWinds Security Event Manager Reports\Export.
  3. Save your changes and close the files.

Schedule the Reports to Run using Windows Task Scheduler

Schedule your batch reports to run using Windows Task Scheduler. Complete the following procedure twice: once for the daily reports and once for the weekly reports.

  1. Create a new scheduled task by opening Control Panel > Administrative Tools > Task Scheduler.

  2. Select Task Scheduler Library.

  3. In the Actions pane, click Create Basic Task.

  4. Enter a name for your task that reflects the frequency of the scheduled task. For example, enter SEM Reports - Weekly for the weekly task, and then click Next.

  5. Select Daily or Weekly, depending on what batch of reports you are scheduling, and then click Next.

  6. Set the start time and frequency for your scheduled reports, and then click Next.

    • For the daily task: 1 AM, Recur every 1 Day
    • For the weekly task: 3 AM, Recur every 1 week, Monday

  7. Select Start a program, and then click Next.

  8. For the Program/script field, click Browse to browse for SWSEMReports.exe. See Step 1 in Prepare the INI file " on the previous page for the default installation paths.

  9. In the Add arguments (optional) field, enter the following, according to the task being created:

    • Use the %ProgramFiles(x86)% environment variable on 64-bit computers.
    • The /l at the beginning of the additional argument is optional. This generates a log file called SWSEMReports.log when Task Scheduler runs your task. The file is saved in %ProgramFiles%\SolarWinds Security Event Manager Reports.

  10. For the daily task: /l "%ProgramFiles%\SchedINI\BATCHDay.ini"

  11. For the weekly task: /l "%ProgramFiles%\SchedINI\BATCHWeek.ini"

  12. Click Next.

  13. To verify the task details on the Summary dialog, select Open the Properties dialog for this task when I click Finish, and then click Finish.

  14. To change the user account the task scheduler should use to complete the task, click Change User or Group.

    • Provide a user with administrator level permissions.
    • If you specified a network location in Step 2 in Prepare the INI file " on page 13, provide a user with write permissions to that folder.
    • Use a service account to avoid having to maintain the task according to your password change policy.
  15. On the Properties dialog, select Run whether user is logged on or not.

  16. Select Run with highest privileges.

  17. Select the appropriate operating systems in the Configure menu, and then click OK to save your changes and exit the Properties dialog.

  18. Enter the Windows password for the user specified for this task, and then click OK.

Default Report Schedules

Once configured, the scheduled tasks run and export the following reports:

Daily Reports

  • EventSummary.pdf
  • SubscriptionsByUser.pdf
  • Incidents.pdf
  • NetworkTrafficAudit.rpt

Weekly Reports

  • MaliciousCode.rpt
  • NetSuspicious.rpt
  • NetAttackAccess.rpt
  • NetAttackDenial.rpt
  • Authentication.rpt
  • FileAudit.rpt
  • MachineAudit.rpt
  • ResourceConfiguration.rpt
  • You can open reports with the .rpt extension in the SEM reports application for filtering and exporting. If you have a program like Crystal Reports associated with this file format, you can access these reports with the SEM reports application by opening SEM Reports first and then clicking Open on the Settings tab.
  • If you create a scheduled report, you can remove the task from Windows task scheduler, and the .ini file will still be under the SchedINI directory. You can change the name of the RPTxxxxx-x.ini to BRPTxxxxx-x.ini, and add the file to the BatchDay.INI or the BatchWeek.INI.

Edit a scheduled report in the Task Scheduler

When you create custom and scheduled reports, SolarWinds recommends that you document your procedures for disaster recovery.

The scheduled Report INI files are located in: Program Files\SolarWinds Security Event Manager Reports\SchedINI. These report INI files are generated automatically when you schedule a report on the SEM Console. If you need to edit an INI file or change a report format, add the corresponding report format after the equal sign to the line containing "ExportFormat= ".

The following table identifies the number assigned to each possible format for a SEM report.

Number Report Format
1 Excel: MS Excel 97-2000, with headings format
2 Exceldata: MS Excel 97-2000, data only format
3 HTML32: HTML version 3.2 format
4 HTML40: HTML version 4.0 format
5 PDF: Adobe Portable Document format
6 RTF: Rich Text Format
7 CSV: Separated Values Text format
8 TAB: Tab Separated text format
9 Text: Text based report format
10 Word: MS Word Document format
11 XML: XML Document format
12 RPT: Crystal RPT w/ Data format

Below is an example of a SEM scheduled report INI file:

Filename=C:\Program Files\SolarWinds Security Event Manager Reports\Reports\RPT2009-33-1.rpt
RptStartTime=12:00:00 AM
RptStopTime=11:59:59 PM
ExportDest=C:\Program Files\SolarWinds Security Event Manager Reports\Export