Objective 

1. Historic log collection: Can be used during device onboarding to collect all logs available in Event Viewer.
2. Log import: Can be used to collect archived Event Viewer log files after onboarding the device.
   

Prerequisites 

• Logs must be present in Event Viewer.
• Required user and network permission to add the Windows device.
• Regular license as needed for adding a Windows log source.

• One Application license for each log file imported.
• The necessary ports and permissions to perform log import (see chart below).
  

Steps to follow 

Enabling historic log collection

Log import

• Click Browse and select the EVT/EVTX file(s) that you would like to import.
• The log format will be auto-identified or can be selected as a Windows Archive File.
• Click the + button and OK to select the device that the log file is associated with. You can also enter the name of the device or select the device from the pop-up window.
• If you wish to store the imported logs for only two days, enable the Store logs for a short term option. By default, the log storage time-period is 32 days.
• Click Import.
• Once the import is completed, the data will be visible with available predefined parser, and you can view the data based on the timestamp recorded in the log message.
  

• Username and password
• SSH private key file sharing (specific to SFTP protocol)
  

• Click the + Import Logs option in the top right corner of the screen.
• In the Browse File(s) section, select Remote Path tab.
• In the Device field, enter the device name from which you wish to import the log file or click the + icon to browse for and select the Windows device.
• In the Protocol drop-down, choose the required protocol, SMB-Windows or FTP and SFTP, and enter the port number.
• Provide the Username of the remote device and the Password field will pop-up.
• Enter the Password in the field.
• Use the Browse button to browse for and select the file to be imported and click OK.
• The Store Logs for Short-term option will store the imported log data in EventLog Analyzer for two days. If the option is left unchecked, the logs will be stored as per your data retention configuration.

• From the Browse File(s) options listed, select Remote Path.
• In the Device field, enter the device name from which you wish to import the log file. Alternatively, you can click the + icon to browse for and select the Windows device.
• Choose SFTP as the protocol and enter the port number (default port value is 22).
• Provide the Username and choose Key File as the Authentication Type.

• Click Browse and select the key file from the device. You can refer to this page to learn how to generate a key file with ssh-keygen, a standard component of Secure Shell protocol.
• If the key file is passphrase protected, select the Use Passphrase check box and enter the phrase in the field.
• In the File field, click the Browse button to browse for and select the file to be imported.
• The Store Logs for Short-term option will store the imported log data in EventLog Analyzer for two days. If the option is left unchecked, the logs will be stored as per your data retention configuration.
• Click Import to save the configuration.

Tips 

1. If there's an interruption in the log collection due to any environmental factors:

• The application resumes the log collection if the events are available in the Event Viewer in agentless log collection.
• For agent-based log collection, the agent can perform log collection locally and forward it to EventLog Analyzer server once connection is established. To do this, navigate to Agent Settings, enable Offline log collection, and define the maximum storage limit.

1. Log import consumes one Application license for each import performed. If you are importing for auditing needs, you can select the Store Logs for Short-term option, which will store the imported log data in EventLog Analyzer for two days. If the option is left unchecked, the logs will be stored as per data retention configuration.
2. Log import for EVT/EVTX is available for direct import only.
3. Both historic log collection and log import of EVT/EVTX are available in the EventLog Analyzer Windows instance only.

• Importing log files from different locations