{"id":50211,"date":"2022-05-16T09:21:30","date_gmt":"2022-05-16T01:21:30","guid":{"rendered":"https:\/\/version-2.com\/?p=50211"},"modified":"2022-05-30T10:42:09","modified_gmt":"2022-05-30T02:42:09","slug":"events-in-ms-windows-and-pandora-fms-does-anyone-give-more","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2022\/05\/events-in-ms-windows-and-pandora-fms-does-anyone-give-more\/","title":{"rendered":"Events in MS Windows and Pandora FMS, does anyone give more?"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\n

\"\"<\/p>\n\n

If the spreadsheet was the essential application for accounting and massification of personal computers, MS Windows\u00ae operating system was the graphical interface that turned work into something more pleasant and paved the way for web browsers for the Internet as we know it today.<\/em><\/p>\n

Today, in Pandora FMS blog, we discuss:<\/p>\n

Windows Event Monitoring and Pandora FMS<\/strong><\/h2>\n

Decades ae gone by but there is always a joke, among us computer scientists, that prevails in time:<\/p>\n

\u201cThis is the year of Linux on our desktops\u201d.<\/em><\/p>\n

I actually think that, in the end, it is a statement that comes with a flaw from the very beginning:<\/p>\n

The kernel (Linux in this case) has little to do with the graphical interface, the actual thing is that the applications that go along with Linux, such as GNU\/Linux<\/strong>, are the combinations that should take their place in hundreds of millions of computers in our homes and jobs.<\/p>\n

The MS Windows\u00ae operating system (OS), despite losing ground with Android\/Linux on our mobile phones, still has it still going on on desktop computers and in the field of video games it keeps its position, faring pretty well.<\/p>\n

Many say that desktop personal computers will disappear. I personally think that we will connect the monitor, keyboard and mouse to our cell phones at home and at the office.<\/p>\n

But today MS Windows has a stronghold in its market position and for Pandora FMS it has implied a series of very special considerations for its monitoring.<\/p>\n

The  overview<\/h3>\n

Monitoring with Pandora FMS can be done both remotely and locally and the MS Windows\u00ae OS is no exception. Remote monitoring can be performed through SNMP and  through WMI<\/a>.<\/p>\n

*If you are new to monitoring, I recommend you to take a few minutes to learn about <\/em>Pandora FMS Basics<\/em><\/a>.<\/em><\/p>\n

For local monitoring install a small program, which is called Pandora FMS Software Agent<\/strong>.<\/p>\n

Once installed in MS Windows\u00ae, the modules to collect the most relevant information (disk usage, RAM consumption, etc.) will already be installed by default.<\/p>\n

If what you need to monitor is the basics of MS Windows\u00ae the Open version of Pandora FMS is more than enough for the task.<\/p>\n

Windows\u00ae event monitoring<\/h3>\n

The amount of applications for MS Windows\u00ae is humongous but in a way it is easy to monitor applications and even processes, since we have a special instruction for the Software Agent called module_Proc. <\/p>\n

This instruction is able to tell us, either immediately or every certain period of time whether a program or process is running.<\/p>\n

*If you want to find out more about this Pandora FMS feature, visit our video tutorial<\/em> Monitor processes or applications in Windows<\/em><\/a>.<\/em><\/p>\n

So far all this is the basics for monitoring MS Windows\u00ae.<\/p>\n

And in the case of Pandora FMS Enterprise version you can \u201ctransfer\u201d normal events to events in Pandora FMS, which can generate alerts and warnings for us to take the necessary actions, or let Pandora FMS restart the software vital to our work or business.<\/p>\n

* The latter is known as Watchdog: if an application for any reason stops in MS Windows\u00ae, it is re-launched and executed.<\/em><\/p>\n

Analyzing the causes<\/h3>\n

Simplifying as much as possible:
So far we can say that we are working on true and false, on ones and zeros.<\/p>\n

But often it is called on to us to analyze under what conditions an application collapses or find out why it does not start.<\/p>\n

If all that related information had to be seen on your screen you simply would not be able to work with so many interruptions<\/strong>. For that reason there are event registries and working with them implies more specialization on Pandora FMS behalf.<\/p>\n

MS Windows\u00ae presents an advantage as a privative software for its monitoring and it is that its events and corresponding logs<\/a> are centralized after a certain routine or standard way.<\/p>\n

Monitoring an individual event<\/h3>\n

Pandora FMS offers the instruction module_logevent that uses Windows\u00ae API and offers better performance than data collection by means of WMI.<\/p>\n

You will obtain data from the event logs from Windows itself.<\/p>\n

Along with additional instructions, it offers the ability to monitor very specific events identified by the fields Log Name, Source, Event ID and Level.<\/p>\n

Remember I told you they\u2019re standardized?<\/p>\n

Well, in Log name they are well defined by:<\/p>\n