Event Log Check Reference

Configuration options for the Windows Event Log check

Written By Erdinc Akay

Last updated About 2 months ago

Event Log Check Reference

Configuration options for the Windows Event Log check

The event log check scans the Windows Event Log for entries at or above a specified severity level and raises an alert when the count exceeds a threshold.

Configuration fields

FieldTypeRequiredDefaultDescription
Event Logslist of stringsNoSystem, ApplicationWhich event logs to scan
Minimum severityradio (one of three)NoCritical + ErrorMinimum severity to match. Inclusive: the selected option includes that level and every more severe level. Options: Critical only, Critical + Error, Critical + Error + Warning. No other values are accepted.
Exclude sourceslist of stringsNo—Event sources to ignore (e.g. ESENT, DistributedCOM)
Lookback period (minutes)minutesNo (advanced)60How far back from the current time to search. Hidden behind Show advanced options under the Query settings section.
Max events per logintegerNo (advanced)50Maximum number of events to retrieve per log. Hidden behind Show advanced options under the Query settings section.
Warning threshold (event count)integerNo (advanced)5Number of matching events that triggers a warning. Hidden behind Show advanced options under the Thresholds section.
Critical threshold (event count)integerNo (advanced)20Number of matching events that triggers a critical result. Hidden behind Show advanced options under the Thresholds section.

Severity levels

LevelValueDescription
Critical1System is unusable or data loss has occurred
Error2An operation failed
Warning3Something may need attention soon

Metrics collected

  • Total count of retrieved events across the selected logs, up to the configured maximum
  • Individual matching entries (source, event ID, message, timestamp)
  • List of logs that were requested but could not be read

Platform support

PlatformSupported
WindowsYes
LinuxNo (use System Log check)
macOSNo (use System Log check)

Notes

  • The check runs every 15 minutes by default. Interval is a check-level setting and is not part of the per-assignment configuration.
  • Set the lookback period to match or exceed the check interval to avoid gaps between runs.
  • Common noisy sources to exclude: ESENT, DistributedCOM.
  • By default the check retrieves up to 50 events per log (configurable via Max events per log) to keep the result payload manageable. If you need more detail, open the device's Event Log view in the toolbox to browse entries directly — or query the event log via the remote terminal.

See also: Configure an Event Log Check