EventMaster - Event Log Monitoring and Collection

Features That Set Us Apart

1. Multi-Purpose
2. Publish and Subscribe Architecture for Alerts
3. Rate-Based Alerting
4. Robust, Reliable and Scalable

1. Multi-Purpose

We believe in keeping it simple. With just an investment in EventMaster, you have the flexibility to monitor and alert on anything that can write a message to an Event Log! And MORE!

• Security Auditing: If you turn on NTFS or Active Directory Auditing, events are written to the Security Event Log, and you can monitor them with EventMaster.
• SNMP or SYSLOG Devices: With the included EventMaster Syslog Collector, you can also monitor your network devices or UNIX/Linux-based computers with EventMaster.
• System Checks*: If you have a script or program that checks for
  • Low disk space
  • Performance counter thresholds
  • Errors in log files from other systems
  • Up-to-date anti-virus definitions
  you can have it write an error to the event log, and monitor it with EventMaster.

*We can help you add "System Checks" scripts. We have many sample scripts available upon request, and also provide script-writing services.

In addition, with EventMaster, comes the underlying MessageMaster. If you have in-house applications, scripts, logon scripts, etc., with a bit of simple code your systems can report errors and other information directly to MessageMaster. You and your developers can see exactly what is happening inside your software, and act to proactively improve your systems and assist your users.

2. Publish and Subscribe Architecture for Alerts

Publish: Once you are funelling error messages and logs from many different sources into EventMaster and MessageMaster, they are collected in the central database. In a sense, in this way they are "published", and available for administrators to subscribe to.

Subscribe: Administrators can browse the consolidated collected messages, and then subscribe to those of interest. Each administrator has their own subscriptions, and chooses how they wish to be alerted.

Alerts: Administrators can receive alerts in different ways, allowing them to choose the level of importance for different alerts.

• If a subscription to a particular event is seen as Critical, its alerts can go directly to email, either text-only or HTML.
• Less critical alerts can be allowed consolidate into a Daily Email, and be reviewed in the morning as a group.
• Finally, alerts that an administrator just want to keep an eye on can go to their individual 'MyMessages' page, which can be checked and cleared at leisure.

Delegation: Senior Administrators can assign different types of issues to various junior administrators. For instance, security issues can be delegated to your security officer or security expert, while printer issues and user account lock-outs can be delegated to your front-line help desk staff.

No one has time to constantly monitor a console in order to know what's happening. The subscription-based system of alerts allows your administrators to concentrate on other tasks, and allow alerts to let them know when there is trouble.

3. Rate-Based Alerting

Getting alerts every time subscribed events enter the central database is great, but what if it is normal for an event to happen once an hour, or once a day. In this case, you only want to be alerted if it happens more often - for example, more than 2 times in one hour, or more than 4 times in one day.

That's where rate-based alerting comes in. As part of each subscription is the option to make it rate-based. Administrators can avoid receiving useless alerts of events that are harmless when they happen only periodically. But when the same event happens with the frequency that the subscription's rate-based option specifies, only then will the administrator be alerted.

4. Robust, Reliable and Scalable

Events are never missed. With EventMaster, even when a client's connection to the server is lost, events are not. The local client agent continues to collect them, and as soon as the client re-connects to the network, they are sent in.

This is true even in cases when the client is still on the network, but has a problem that would make it un-reachable by the server in a polling-based system. For instance, the client is running firewall software, or has temporarily lost its trust with the domain.

Even if the central database goes down for a time, events are not lost but cached in the incoming message queue. Once everything is restored, the server software will catch up on the backlog, and all events will be delivered. Always.

Download a fully-functional evaluation copy of Objective Software's EventMaster now.