Looking for a comprehensive log aggregation monitor for a small Windows domain

Going through the daily logs on 12 servers is becoming too cumbersome. I working with a small domain including remote offices of about 50 users and less than 100 devices, mostly Windows clients. I looking for a way to aggregate the logs and filter for items that I need to monitor, not the entries that I know I can ignore. Small business = small budget, so my options are somewhat limited and I really don't have the time or energy to implement an enterprise class solution that requires 6 months of training just to understand. So with that said, what are your suggestions?
LVL 2
GISCOOBYDirector of Information TechnologyAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

McKnifeCommented:
Use scripts to filter the logs and put the output into a file that is somewhat small and readable. Powershell has commands for that (get-wineventlog). An old batch tool that you can still download is eventcomb.exe (from microsoft).
And there is also this:  https://blogs.technet.microsoft.com/otto/2008/07/08/quick-and-dirty-large-scale-eventing-for-windows/
0
Shimshey RosenbergSysAdminCommented:
0
McKnifeCommented:
Sorry, small correction on the powershell command: it is get-winevent
0
Acronis True Image 2019 just released!

Create a reliable backup. Make sure you always have dependable copies of your data so you can restore your entire system or individual files.

ITguy565Commented:
There are several solutions you can use but it all depends on how indepth you want your monitoring to be.

This is the solution, I think would work best for you at the moment. It has a straight forward discovery, installation, and monitoring engine.

https://www.manageengine.com/network-monitoring/server-monitoring.html?msclkid=2bb5a40c0c191a26b863feb799c2afbe&utm_source=bing&utm_medium=cpc&utm_campaign=OpManager%20-%20Core&utm_term=server%20monitoring&utm_content=Server%20Monitoring
0
Peter SarabySenior IT ProCommented:
Yes, you definitely don't want to be looking at logs manually! I stopped doing that 15 years ago :-)

While it's certainly possible to create a "solution" using scripts, I'd recommend against it if you're not regularly working with PowerShell. It's not that scalable and will likely require a lot of your time - all while providing you with limited reporting abilities.

ManageEngine's products are ok, but IMHO there are better solutions out there. If your environment is mostly Windows then I would take a look at EventSentry. It does the basic log monitoring & reporting you need (optimized for Windows), but also includes system health monitoring (performance, disk space, inventory, ...) and it's not expensive at all (at least not compared with other comparable solutions). Their support is good too.

You also have a lot of open source solutions at your disposal, but those will generally require more time to setup and maintain.

Hope this helps.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Dirk KotteSECommented:
i use splunk light as log aggregator within small lans.
0
GISCOOBYDirector of Information TechnologyAuthor Commented:
I haven't dropped the question, I'm just taking my time to analyze the suggestions. So far I like the cost of PowerShell and know how to utilize it. I just know it's easy to get caught in the rabbit hole, digging deeper and deeper without finding an acceptable output I want. The Splunk Light looks nice, but when compared to EventSentry it doesn't even compare. My only issue with the EventSentry is the cost. Might be a tough sell on C-types for an event system, even though the capability can replace other products I subscribe to.
0
Peter SarabySenior IT ProCommented:
I completely understand regarding PowerShell, and if you can create the report(s) that you need with it, then by all means I would go that route. But like you said, it's a potential time sink. It probably depends on whether you'll have a use for all the functionality EventSentry has included. If you do then it probably makes sense to take a closer look at it.

EventSentry's pricing is pretty fair IMHO, but that obviously depends on how much of it you'll be utilize, and what your budget looks like. If you already have similar products then why don't you ask them for competitive upgrades? I know that some vendors offer decent discounts if you switch from a competitive product. I don't know if they do, but it's worth a shot I think.
0
Technical EngeneerTechnical Support SpecialistCommented:
NetCrunch can handle that for you, completely remotely and without any agents. This might be the most pain-free way to do it, especially when you have several machines to monitor. Here's a KB on that: https://www.adremsoft.com/blog/view/blog/7483494443299/monitoring-text-log-files-with-netcrunch , https://www.adremsoft.com/adoc/view/netcrunch/5998261774627/monitoring-text-logs
0
GISCOOBYDirector of Information TechnologyAuthor Commented:
I didn't get to fully invest my research into the solutions, especially Mariusz J.'s recommendation. Thanks everyone for your input. I gave Peter Saraby the credit because if I can wrangle his solution into the budget, that definitely they way I want to go. The Event Sentry product looks extremely comprehensive. Again, thank you everyone.
2
ITguy565Commented:
Glad you found your answer!
0
McKnifeCommented:
May I ask why the free and built-in way that Microsoft has documented step by step is not suitable?
0
GISCOOBYDirector of Information TechnologyAuthor Commented:
McKnife, as I mentioned in my closing statement, I love working with PowerShell; but I find that it can easily be overwhelming, especially when aggregating data. While I only have 12 servers, I can easily get overwhelmed sifting through the amount of data that is presented from them, half of which can be ignored. Again, thanks for your input, I just decided to go a different direction.
0
McKnifeCommented:
No powershell required. Please scroll again through my link https://blogs.technet.microsoft.com/otto/2008/07/08/quick-and-dirty-large-scale-eventing-for-windows/ - not a single line of powershell.
It is an understandable tutorial about the free, built-in way to collect events centrally.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows OS

From novice to tech pro — start learning today.