Security Event Log - OS Test

How often should the test be executed.

The host for which the test is to be configured.

The default port is NULL.

To obtain the 'inside view' of performance of the cloud-hosted virtual desktops - i.e., to measure the internal performance of the virtual desktops - this test uses a light-weight eG VM Agent software deployed on each of the desktops. Accordingly, this parameter is by default set to eG VM Agent.

Refers to the type of event logs to be monitored. The default value is system.

This test can be configured with the event sources, event IDs, and event descriptions to be monitored. In order to enable administrators to easily and accurately provide this specification, this page provides the following options:

• Manually specify the event sources, IDs, and descriptions in the Filter text area, or,

• Select a specification from the predefined filter policies listed in the Filter box

For explicit, manual specification of the filter conditions, you first need to select the No option against the Policy filter field. This is the default selection. To choose from the list of pre-configured filter policies, or to create a new filter policy and then associate the same with the test, select the Yes option against the Policy Filter field.

If the Policy Filter flag is set to No, then use the Filter text area to specify the event sources, event IDs, and event descriptions to be monitored. This specification should be of the following format: {Displayname}:{event_sources_to_be_included}:{event_sources_to_be_excluded}:{event_IDs_to_be_included}:{event_IDs_to_be_excluded}:{event_descriptions_to_be_included}:{event_descriptions_to_be_excluded}. For example, assume that the Filter text area takes the value, OS_events:all:Browse,Print:all:none:all:none. Here:

• OS_events is the display name that will appear as a descriptor of the test in the monitor UI;

• all indicates that all the event sources need to be considered while monitoring. To monitor specific event sources, provide the source names as a comma-separated list. To ensure that none of the event sources are monitored, specify none.

• Next, to ensure that specific event sources are excluded from monitoring, provide a comma-separated list of source names. Accordingly, in our example, Browse and Print have been excluded from monitoring. Alternatively, you can use all to indicate that all the event sources have to be excluded from monitoring, or none to denote that none of the event sources need be excluded.

• In the same manner, you can provide a comma-separated list of event IDs that require monitoring. The all in our example represents that all the event IDs need to be considered while monitoring.

• Similarly, the none (following all in our example) is indicative of the fact that none of the event IDs need to be excluded from monitoring. On the other hand, if you want to instruct the eG Enterprise system to ignore a few event IDs during monitoring, then provide the IDs as a comma-separated list. Likewise, specifying all makes sure that all the event IDs are excluded from monitoring.

• The all which follows implies that all events, regardless of description, need to be included for monitoring. To exclude all events, use none. On the other hand, if you provide a comma-separated list of event descriptions, then the events with the specified descriptions will alone be monitored. Event descriptions can be of any of the following forms - desc*, or desc, or *desc*,or desc*, or desc1*desc2, etc. desc here refers to any string that forms part of the description. A leading '*' signifies any number of leading characters, while a trailing '*' signifies any number of trailing characters.

• In the same way, you can also provide a comma-separated list of event descriptions to be excluded from monitoring. Here again, the specification can be of any of the following forms: desc*, or desc, or *desc*,or desc*, or desc1*desc2, etc. desc here refers to any string that forms part of the description. A leading '*' signifies any number of leading characters, while a trailing '*' signifies any number of trailing characters. In our example however, none is specified, indicating that no event descriptions are to be excluded from monitoring. If you use all instead, it would mean that all event descriptions are to be excluded from monitoring.

By default, the Filter parameter contains the value: all:all:none:all:none:all:none. Multiple filters are to be separated by semi-colons  (;).

Note:

The event sources and event IDs specified here should be exactly the same as that which appears in the Event Viewer window.  

On the other hand, if the Policy Filter flag is set to Yes, then a Filter list box will appear, displaying the filter policies that pre-exist in the eG Enterprise system. A filter policy typically comprises of a specific set of event sources, event IDs, and event descriptions to be monitored. This specification is built into the policy in the following format:

{Policyname}:{event_sources_to_be_included}:{event_sources_to_be_excluded}:{event_IDs_to_be_included}:{event_IDs_to_be_excluded}:{event_descriptions_to_be_included}:{event_descriptions_to_be_excluded}

To monitor a specific combination of event sources, event IDs, and event descriptions, you can choose the corresponding filter policy from the Filter list box. Multiple filter policies can be so selected. Alternatively, you can modify any of the existing policies to suit your needs, or create a new filter policy. To facilitate this, a encircled '+' button appears alongside the Filter list in the test configuration page, once the Yes option is chosen against Policy Filter. Clicking on this button leads you to a page where you can modify the existing policies or create a new one (refer to page Security Event Log - OS Test). The changed policy or the new policy can then be associated with the test by selecting the policy name from the Filter list box in this page.

By default, this parameter displays none, indicating that by default none of the successful log audits will be reflected in the detailed diagnosis. If you set this parameter to, say 10, then the test will display only the 10 most recent successful log audits in the detailed diagnosis page. Setting this parameter to all, on the other hand will make sure that all successful log audits are listed in the detailed diagnosis.

By default, this parameter displays all, indicating that by default all the failed log audits will be reflected in the detailed diagnosis. If you set this parameter to, say 10, then the test will display only the 10 most recent log audits that failed, in the detailed diagnosis page. Setting this parameter to none, on the other hand will make sure that none of the failed log audits are listed in the detailed diagnosis.

This flag is set to Yes by default. The value of this flag cannot be changed. This implies that the virtual machines in VDI environments will always be identified using the login name of the user. In other words, in VDI environments, this test will, by default, report measures for every username_on_virtualmachinename.

This flag is relevant only for those tests that are mapped to the Inside View of Desktops layer. If this flag is set to Yes (which is the default setting), then the 'inside view' tests will report measures for even those virtual desktops that do not have any users logged in currently. Such desktops will be identified by their name and not by the username_on_virtualdesktopname. On the other hand, if this flag is set to No, then this test will not report measures for those virtual desktops to which no users are logged in currently.  

Since this test runs for every virtual desktops component which is a cloud-hosted desktop group, this flag is set to Yes by default.

Refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD Frequency.