Product Reviews

Make Sense of Your Data

Aelita EventAdmin gathers Event Log information and helps you get a handle on it.


The Windows 2000 event log is a great thing. It’s a standardized way for applications on a Win2K computer to log information and error messages for the administrator to resolve. Unfortunately, it’s difficult to manage the event logs of all of the servers in a large organization. That difficulty is due, in part, to the sheer number of messages recorded in the average set of event logs. This is particularly true for organizations that log a variety of security events.

Aelita’s EventAdmin is designed to help you get a handle on your events. Like other similar products, EventAdmin allows you to gather information about the happenings on each server and compile that into one, large database. Where EventAdmin shows its true value is in generating meaningful ways to look at the consolidated event data.

The included reporting console allows you to run a variety of reports, including my favorite, “Events by MSDN article,” which helps you identify the resources you should review to resolve errors occurring on the network. Other predefined reports include the number of reboots a server has undergone, license manager warnings, performance data and problems by computer.

Perhaps one of the most interesting ways EventAdmin helps you make sense of all of the event data is by allowing you to use the high-powered Online Analytical Processing (OLAP) tools included with SQL Server. OLAP allows you to view data in a high-level, cross-tab format and drill down into more detail. OLAP works by providing a series of dimensions or criteria that can be placed in either rows or columns. Each dimension can be collapsed or expanded. For instance, you can view the results of a query for all of the computers by domain or you can expand the dimension to the computers in the domain to see a computer-by-computer breakdown.

EventAdmin even allows periodic queries to be run against the database of events, the results of which can be sent via e-mail, pager, network message, SNMP trap, or a custom program. This is great for sending daily or weekly status reports on the health of the network. However, this isn’t the kind of instant monitoring and notification you might find in other event log management products. It looks back at the database of events over a period of time. This means that it doesn’t support instant notification of events; rather, it supports summarized reporting of the events that have been logged.

EventAdmin
EventAdmin can help you determine the root cause of entries in your event logs. (Click image to view larger version.)

The biggest problem with EventAdmin today is that the documentation and online help leave a lot to be desired. Trying to figure out the product is more like exploring a new land than following a map. The product itself is robust enough to automatically create or rebuild the things it needs in most cases. This allows you to stumble through without too many errors. I had to call technical support to figure out how to create the OLAP database, but the process of creating the database itself was simple when I understood how to do it.

EventAdmin is a must for those organizations with multiple servers, particularly when many security events are audited. EventAdmin truly makes it easy to reduce the number of events in the event log and to resolve reoccurring problems.

About the Author

Robert Bogue, MCSE, has contributed to more than 100 book projects and numerous other publishing projects. Robert is a technical consultant for Crowe Chizek in Indianapolis. His latest book is Mobilize Yourself! The Microsoft Guide to Mobile Technology (is available wherever books are sold. He is also a frequent contributor to CertCities.com.

comments powered by Disqus
Most   Popular