Event Log Check Reference

Configuration options for the Windows Event Log check

Written By Erdinc Akay

Last updated About 2 months ago

Event Log Check Reference

Configuration options for the Windows Event Log check

The event log check scans the Windows Event Log for entries at or above a specified severity level and raises an alert when the count exceeds a threshold.

Configuration fields

Field	Type	Required	Default	Description
Event Logs	list of strings	No	System, Application	Which event logs to scan
Minimum severity	radio (one of three)	No	Critical + Error	Minimum severity to match. Inclusive: the selected option includes that level and every more severe level. Options: Critical only, Critical + Error, Critical + Error + Warning. No other values are accepted.
Exclude sources	list of strings	No	—	Event sources to ignore (e.g. ESENT, DistributedCOM)
Lookback period (minutes)	minutes	No (advanced)	60	How far back from the current time to search. Hidden behind Show advanced options under the Query settings section.
Max events per log	integer	No (advanced)	50	Maximum number of events to retrieve per log. Hidden behind Show advanced options under the Query settings section.
Warning threshold (event count)	integer	No (advanced)	5	Number of matching events that triggers a warning. Hidden behind Show advanced options under the Thresholds section.
Critical threshold (event count)	integer	No (advanced)	20	Number of matching events that triggers a critical result. Hidden behind Show advanced options under the Thresholds section.

Severity levels

Level	Value	Description
Critical	1	System is unusable or data loss has occurred
Error	2	An operation failed
Warning	3	Something may need attention soon

Metrics collected

Total count of retrieved events across the selected logs, up to the configured maximum
Individual matching entries (source, event ID, message, timestamp)
List of logs that were requested but could not be read

Platform support

Platform	Supported
Windows	Yes
Linux	No (use System Log check)
macOS	No (use System Log check)

Notes

The check runs every 15 minutes by default. Interval is a check-level setting and is not part of the per-assignment configuration.
Set the lookback period to match or exceed the check interval to avoid gaps between runs.
Common noisy sources to exclude: ESENT, DistributedCOM.
By default the check retrieves up to 50 events per log (configurable via Max events per log) to keep the result payload manageable. If you need more detail, open the device's Event Log view in the toolbox to browse entries directly — or query the event log via the remote terminal.

See also: Configure an Event Log Check