sohobion.blogg.se - Logtail windows

LOGTAIL WINDOWS FULL
LOGTAIL WINDOWS WINDOWS

In this case, the log with the specified event ID is not collected. You can also specify an event ID for negative filtering. In this case, the log with the specified event ID or the logs with the specified event IDs are collected. You can specify an event ID or a range of event IDs for positive filtering. You can configure this parameter to filter logs by event ID.

LOGTAIL WINDOWS WINDOWS

This parameter is supported only in the Windows Vista operating system or later. Note This parameter is available only when Windows Event Log API is used.

In this case, all historical event logs on your server are collected.

If you set the value to 14400, logs that are generated 4 hours before the start time of collection are ignored.īy default, this parameter is left empty, which indicates that logs are not filtered by event time.

If you set the value to 3600, logs that are generated 1 hour before the start time of collection are ignored.

The event time indicates the time when a log is generated. If the event time of a log is earlier than the start time of collection minus the offset, the log is ignored. You can configure this parameter to filter logs by event time.

LOGTAIL WINDOWS FULL

You can view the full name of a channel in the Windows operating system. This value indicates that event logs are collected from the Application channel. The name of the channel from which you want to collect event logs.

In the left-side navigation pane, expand Windows Logs.įor example, if you want to collect logs from the Application and System channels, you can add the following elements to the inputs parameter:.

You can view the information about a channel in the Event Viewer window of your Windows server. For example, you can collect event logs from the application and system channels at a time. Logtail allows you to collect event logs from multiple channels at a time. This way, Logtail can continuously collect event logs and send the logs to Log Service. Logtail uses the required plug-in to call Windows Event Log API or Event Logging API to subscribe to the channel.

An application or kernel publishes event logs to a specified channel, such as an application, security, or system channel. The publish-subscribe model is used to collect Windows event logs. Windows Event Log API is preferentially selected. Logtail plug-ins automatically select an API based on the operating system to obtain Windows event logs. For more information, see Windows Event Log and Event Logging. Windows Event Log API is an upgraded version of Event Logging API and is provided only in the Windows Vista operating system or later. To obtain event logs, Windows operating systems provide Windows Event Log API and Event Logging API. For more information, see Read log files. If a log file on a server is not updated after the applied Logtail configuration is delivered to the server, Logtail does not collect logs from the file. Important Logtail collects only incremental logs.