How to monitor Event Logs in "Applications and Services Log" ?

How to monitor Event Logs in "Applications and Services Log" ?

Explanation :
Upon investigation, we discovered that the Win32_NTLogEvent WMI class, by default, includes only standard Event Log categories found under "Windows Logs." To access specific log names under "Applications and Services Logs," a corresponding registry entry for the desired log must be added. Once this entry is configured, users will be able to access the Event Log through the Win32_NTLogEvent class.

Requesting to follow the steps :
  1. Take a backup of the registry.
  2. Open the Event Viewer, expand the tree containing the required log and then copy the content of the Full Name field from the Properties window:
    1. Example: Microsoft-Windows-DateTimeControlPanel/Operational
  3. Open the registry using the registry editor (regedit.exe) and navigate to the following path : "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog"
  4. Right click Eventlog -> New -> Key. Provide the value copied in step 2, for the Key.
  5. Close the registry editor to save the changes.
  6. To monitor "DateTimeControlPanel" event, you should create New Event Log in Applications Manager.
    1. Settings -> Log Rules -> Add New Event Log
  7. In the Add New Event Log Windows, the New Event Log Name should be added as 'Microsoft-Windows-DateTimeControlPanel/Operational' as given in the registry.
Now, create an event on the target server and execute the below script under <APM_Home>\working\conf\application\scripts directory. Kindly check log name in the script argument is the same as the name provided in the registry.
  • cscript event.vbs "Hostname" "Username" "password" 300 "microsoft-windows-datetimecontrolpanel/operational" 500
NotesNote: You need to replace hostname, username and password with actual credentials used in Applications Manager for the reported server.

                  New to ADSelfService Plus?