LogWatcher Overview

LogWatcher is an advanced utility designed to search through Windows NT event logs to find certain keys that you define, and to execute special tasks when it finds them. LogWatcher will search logs on multiple remote computers, and will examine any of the event logs on those machines for any combination of fields and values you want. LogWatcher provides a convenient place for you to view, clear, and annotate those logs.

LogWatcher also supports text-based event logs, typical of those created by unattended processes that do not write to the Windows NT event log. For text files that are generated daily with date-based names, you can define a simple name template, and LogWatcher will keep track of the appropriate log file name. If you are only interested in text log scanning, then you can install LogWatcher on Windows 95/98, but you will not be able to use the NT Event Log support.

How does it work? To begin monitoring an NT Event log, you simply use our network browser to list all the available event logs on the computers you are interested in, and just check the actual logs you wish to watch. These logs show up in the left pane of the explorer, and you can view their contents simply by clicking on them. This lets you very quickly review recent events, just by working your way down the list.

The value of LogWatcher is its ability to do this searching for you in the background, and perform a task you specify when it finds the keys you want. You do this by defining watch groups for the logs you are interested. A watch group is just the keys you want to watch, and the task that those particular keys will trigger. You can configure as many combinations of keys and tasks as you want.

The keys can be any combination of the fields in an NT event log record. For example, you can define a key to find any occurrences of Event ID 6006 generated by the EventLog service (this is usually logged to the System Log just before a system shuts down). You can easily specify events by types, user, computer, etc. You
can even search the translated message text for text keys!

LogWatcher supports impersonation, so you access protected event logs (like the NT Security log) on other machines.

The task is composed of one or more actions, and can be as simple as a pop-up message box, or a lengthy script composed of the following actions:

Launch other programs
Send E-mail
File operations ( copy, delete )
System operations ( shutdown reboot, etc )
Run a GroundControl macro ( another Acrasoft product )
Write text to file ( handy for sniffer-style applications, like certain paging apps ).
Send Keys
Download Internet URL
NT Service control
Run SQL Script

LogWatcher provides a very handy Quick Start wizard to help you select logs, set up watch groups, and configure keys and tasks, and the help file includes detailed tutorials.

LogWatcher makes working with diverse text and NT event logs very simple. The tedious job of sifting through thousands of lines and records to detect critical warnings is performed continuously and unobtrusively for you.

LogWatcher contains inherent support for MessagePad. MessagePad is an Acrasoft product that displays a scrolling list of text messages. Messages can be sent to MessagePad from the local computer, or more usefully, from a remote computer. These messages are sent from the command line using our SendMsg utility (free with MessagePad), or directly from LogWatcher and AutoPilot. Messages can contain color information that determines how they will be displayed. It is a useful alternative to having message boxes constantly interrupting your work.

LogWatcher is part of the Acrasoft suite of automation products, and supports data transfer between our applications via drag-and-drop, and cut-and-paste. Any tasks you build in MessagePad or AutoPilot are compatible with LogWatcher.

New in version 2.10:

Automatic backups of your configuration workspace file.

Ability to rename a server for NT event logs if you rename or replace a server that you are monitoring.

Optionally disable the creation of the LogWatcher System Log for capturing internal errors.

Minor bug fixes.

New in version 2.00:

Combinational logic provides more flexibility for monitoring events.

Enhanced user interface for faster log browsing and easier configuration.

Detailed auditing features provide better information for resolving problems.

New built-in actions allow for more control.

Task constants allow you to define your own constants for powerful task manipulation.

Impersonation lets you specify alternate login information for wider access to restricted logs.

Windows XP support, including support for XP themes.

On Error action lets you handle unforeseen problems during task execution.

A bug causing LogWatcher to crash when different versions of software logged the same event in inconsistent formats was eliminated.

Minor bugs with the event log viewer were fixed, making it more efficient and reliable.

New in version 1.10:

LogWatcher now supports variables, so you can include translated event message text in e-mail messages, popup display messages, MessagePad messages, and other actions.

LogWatcher now supports a Run SQL Script action. This action also supports the new system variables, so you can write a SQL statement to insert events into an ODBC database.

You can also configure a default SQL editor for working with SQL scripts.

LogWatcher allows you to impersonate authorized accounts when trying to access protected resources like Security event logs on other machines.

LogWatcher has been tested in Windows 2000, and is fully functional. The icons have been updated to be more readable.

The Network Browser lets you type in the name of a computer that is not displayed.

A new "All Event Types" wildcard simplifies event log search keys.

LogWatcher now supports a "third pane" detail view for NT event logs.

System Requirements

Pricing
The following price table is for a single installation license that monitors the given number of computers. For example, a single installation that monitors 10 computers costs $799.95, as opposed to two installations that monitor 5 computers each, which costs 2 * 499.95 = $999.90.