If you installed it as an application, follow the procedure given below to convert the software installation to a Linux Service. EventLog Analyzer displays "Port 8400 needed by EventLog Analyzer is being used by another application. Yes, bulk installation of agents for multiple devices is possible. If you would like to have the files to a different folder, you need to edit the downloaded files and give the absolute path as below:
. Solution: Edit the device's details, and enter the Administrator login credentials of the device machine. Is it possible to alert me if a file is moved? If you have trouble installing the agent using the EventLog Analyzer console, GPOs or software installation tools, you can try to install the agent manually. 3. The audit daemon service is not present in the selected Linux device. The required logs might have been filtered by the log collection filter. x%_xVcoh@# "l!UcGo!,][,xm;B*$dFBPMXPC!-I9),HrVI~"NE!lZwY>AYYt: \l4b '{e PDF Quick start guide - ManageEngine It can be done by navigating to Settings-> Admin Settings-> Manage Agents in the EventLog Analyzer console. ./Change\ ManageEngine\ EventlogAnalyzer\ Installation. Execute the \bin\stopDB.bat file. What are the file operations that can be audited with FIM? Solution 2:If valid KeyStore certificate is used, execute the following command in the /jre/bin terminal. Ensure that they are configured. If the above mentioned reasons are found to be true, please contact EventLog Analyzer technical support for further assistance. To troubleshoot, go to Log Receiver in the EventLog Analyzer dashboard and verify that your machine is receiving log data from the specific syslog device. ManageEngine EventLog Distributed Monitoring Admin Server- Zoho Corporation Pvt. hb```e``Z B@1V ``0!A gfPr:7h}!5\]'b@"ADCb1`AHs4AYYXXX%YC\\ Navigate to Home > Log Sources > File Integrity Monitoring > FIM Alert. 0000003306 00000 n
Start up and shut down batch files not working on Distributed Edition when taking backup. With this the EventLog Analyzer product installation is complete. You need to define SACLs on the File/Folder cluster. While adding device for monitoring, the 'Verify Login' action throws RPC server unavailable error. The default port number is 8400. The probable reason and the remedial action is: Probable cause: The device machine RPC (Remote Procedure Call) port is blocked by any other Firewall. Analyze log data to extract meaningful information in the form of reports, dashboards, and alerts. Can I install Agent on the EventLog Analyzer server? Please contact your SMTP/SMS service provider to address the issue. Open Windows Defender Firewall with Advanced Security in your windows machine and add an inbound rule (port number: 513/514 and protocol: UDP/TCP) to allow the incoming logs. MySQL-related errors on Windows machines. Uncomment the second application parameter ' wrapper.app.parameter.2=-L../lib/AdventNetDeploymentSystem.jar'. Agent Configuration and Troubleshooting Issues. Execute wrapper.exe ..\server\conf\wrapper.conf. 283 0 obj
<>
endobj
296 0 obj
<>/Filter/FlateDecode/ID[<2C6812C00A93D3A38C6F6DC13E8C385E>]/Index[283 35]/Info 282 0 R/Length 75/Prev 446869/Root 284 0 R/Size 318/Type/XRef/W[1 2 1]>>stream
Error messages while adding STIX/TAXII servers to EventLog Analyzer. q[^ND Go to the Settings Tab > System Settings > Connection Settings > Congure Connections. From builds 12130, agents can be deployed in the DMZ. The canned reports are a clever piece of work. Simulate and forward logs from the device to the EventLog Analyzer server. Yes it is safe. The default port number is 8400. HdV$5L;mY8xH_""3jG9mGF>\O?>|>t^yFi%2=,Z~)a[_Zf`dxAQ.ZXV~xk'\`k$.xxf?)SX:f YIz+=e ^rQsW8./%z8V-K\Z arHX3/KIo/.^-qF:-AS0308" Case 4: Logs are displayed in syslog viewer and Wireshark: If you are able to view the logs in syslog viewer and Wireshark but the logs aren't displayed in EventLog Analyzer, go to step 3. Correcting it and retrying it would fix the issue. EventLog Analyzer uses this data to generate reports. Why is EventLog Analyzer's product database (Postgre SQL) not starting? Windows versions greater than 5.2 (Windows Server 2003) are supported. So before proceeding for the troubleshooting tips, ensure that you'd specified the correct time period and logs are available for that period. Reason: Certain reports require configuring Access Control Lists (ACLs). Logs for the report are not properly parsed. When you don't receive notifications, please check if you configured your mail and SMS server properly. Execute the following command in Terminal Shell. If all the agents are in the same Active directory domain, bulk updating the credentials in Settings -> Admin Settings -> Domains and Workgroups will work if the agents were initially added using the domain's credential. When WBEM test is carried out. Probable cause: The device was added when importing application logs associated with it. HdWn$7VDQfr | `RUwm$,?,~>|VL? n|[i^'WkmQ#b-:^}dE]-kr]}rKqPx1fp;jk?d_/ka~FWo. #listen_addresses = 'localdevice' # what IP address(es) to listen on; # defaults to 'localdevice'; use '*' for all. The agent's service might be running but the EventLog Analyzer server may not be reachable to the collector. Ensure that the Mail server has been configured correctly. There is some internal execution failure in the WMI service (winmgmt.exe) running in the device machine. If the EventLog Analyzer service stops abruptly, it could be due to one of the following reasons: The machine in which EventLog Analyzer is running has stopped or is down. 0000002350 00000 n
ManageEngine EventLog Analyzer is not running. If it does not, then the machine is not reachable. Yes. However, the agent upgrade failed. The procedure to take backup of EventLog Analyzer for different databases is given here. Solution: For each event to be logged by the Windows machine, audit policies have to be set. 0000009847 00000 n
With this the EventLog Analyzer product installation is complete. Enter the folder name in which the product will be shown in the Program Folder. The default name is. Select the folder to install the product. ManageEngine EventLog Analyzer is popular among the large enterprise segment, accounting for 54% of users researching this solution on PeerSpot. Forever. Note that once the server is successfully shut down, the PostgreSQL/MySQL database connection is automatically closed, and all the ports used by EventLog Analyzer are freed. ManageEngine EventLog Analyzer Quick Start Guide Contents Installing and starting EventLog Analyzer Connecting to the EventLog Analyzer server 1 2 . The default name is ManageEngine EventLog Analyzer. Whitelist https://creator.zoho.com in your firewall. The inbuilt PostgreSQL/MySQL database of EventLog Analyzer could get corrupted if other processes are accessing these directories at the same time. Solutions ManageEngine | Actualits | / | Page 28 Solution: Refer the Cause and Solution for the Error Code you got during Verify login. Unable to install the agent. If the product is installed as a service, make sure that the account congured under the Log On Enter your personal details to get assistance. You will be asked to confirm your choice, after which the EventLog Analyzer server is shut down. However, third party applications like SNARE can be used to convert the Windows event logs to Syslog and forward it to EventLog Analyzer. Probable cause: The device machine is not reachable from the EventLog Analyzer server machine. Probable cause: The message filters have not been defined properly. Solution: Unblock the RPC ports in the Firewall. 0000001892 00000 n
hb``e``g`e`0 @1vg0h``Vtb6L:++buF7:X9\Z400pt $FA%
0lXZb0f`ZHX$FlLv 60X0|ace`hs`p`W5`a1@em,LQGJ `CREb?
r
| Ever since I upgraded EventLog Analyzer, agent communication has been failing. Remote DCOM option is disabled in the remote workstation. Solution:Configure the server to use either a self-signed certificate or a valid PFX certificate. Find the EventLog client from the process list. If Oracle device is Windows, open Event viewer in that machine and check for Oracle source logs under Application type. Open Resource monitor. Windows: \bin\stopDB.bat file. Search for the event in the search tab of EventLog Analyzer. If these commands show any errors, the provided user account is not valid on the target machine. How can this issue be fixed? EventLog Analyzer displays "Enter a proper ManageEngine license file" during installation. Case 1: Your system date is set to a future or past date. To fix this, you need to enable the listed object access policies for your domain. This is a great help for network engineers to monitor all the devices in a single dashboard. keytool -importkeystore -srckeystore -destkeystore server.pfx -deststoretype PKCS12 -deststorepass -srcalias tomcat -destalias tomcat, Solution: please contact EventLog Analyzer Technical Support. For more details visit Connection settings. 0000001096 00000 n
If the server is started and you wish to access it, you can use the tray icon in the task bar to connect to EventLog Analyzer. Execute the /bin/stopDB.sh file. If the agent's installation folder is deleted before it is deleted from the control panel, this error might occur. 5Dr4 )#w;~-wkLNng}6}n.eyn\r^y]! This will provide required permissions to the \pgsql folder. In Linux , use the command netstat -tulnp | grep "SysEvtCol" to check the Listening status. To try out that feature, download the free version of EventLog Analyzer. Explore the solution's capability to: A quick glance of the topics discussed below should be good enough to let yoube able to deploy, configure, and generate reports using EventLog Analyzer. hbbd``b`AD H @ l+%$Lg`bd\d100-@
&
endstream
endobj
startxref
0
%%EOF
317 0 obj
<>stream
To bind EventLog Analyzer server to a specific interface, follow the procedure given below: rem %JAVA% %JAVA_OPTS% -cp "%CLASS_PATH%" com.adventnet.mfw.Starter %SAFE_START% -c default -b , %JAVA% %JAVA_OPTS% -cp "%CLASS_PATH%" com.adventnet.mfw.Starter %SAFE_START% -c default -b , %JAVA% %JAVA_OPTS% -cp "%CLASS_PATH%" com.adventnet.mfw.Starter %SAFE_START%, rem %JAVA% %JAVA_OPTS% -cp "%CLASS_PATH%" com.adventnet.mfw.Starter %SAFE_START%, rem set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms128m -Xmx512m -Dspecific.bind.address= , set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms128m -Xmx512m -Dspecific.bind.address= , set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms256m -Xmx1024m, rem set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms256m -Xmx1024m, url=jdbc:postgresql://localdevice: 33336/eventlog?stringtype=unspecified, url=jdbc:postgresql://:33336/eventlog?stringtype=unspecified, #------------------------------------------------------------------------------. After changing it to the permissive mode, navigate to. Probable cause 1: Alert criteria might not be defined properly. Generate predefined reports to meet the requirements of regulatory compliance mandates such as PCI DSS, HIPAA, FISMA, SOX, GLBA, SOX, ISO 27001, and more. PDF EventLog Analyzer: GUIDE TO INSTALL SSL CERTIFICATE What could be the reason? To confirm if the device exists, it could be pinged. So by ensuring that the EventLog Analyzer server is continuously reachable by the agent, this issue can be fixed. 0000002466 00000 n
PDF ManageEngine EventLog Distributed Monitoring - Admin Server To fix this, ensure that your EventLog Analyzer instance is properly shut down. You need to verify the reachability of EventLog Analyzer server from the agent where the devices are associated. Place the server's certificate in your browser's certificate store by allowing trust when your browser throws up the error saying that the certificate is not trusted. To add the class, follow the procedure given below: Probable cause:The object access log is not enabled in Linux OS. Right-click logtype and change the log size. By default, this is Start > Programs > ManageEngine EventLogAnalyzer <version number> . The postgres.exe or postgres process is already running in task manager. EventLog Analyzer can audit paste activities of the user. mP(b``; +W. Port already used by some other application. Prior to the EventLog Analyzer's 12120 version, if the credentials are not. The following steps will guide you through the process for enabling SSL in EventLog Analyzer: Step 1: Generate CSR and submit it to your certifying authority Log in to EventLog Analyzer using admin credentials. Key Features OpManager's out-of-the-box solution offers you. Solution 1:If no valid certificate is used, it's recommended to use SelfSignedCertificate. What should I do if the network driver is missing? The device does not have the applications related to the report. Probable cause: The device machine running a System Firewall and REMOTEADMIN service is disabled. Can I deploy the EventLog Analyzer agent on AWS platforms? (or). Status on the Linux agent console is "Listening for logs". It minimizes the amount of time we spent on filtering through event logs and provides almost near real-time notification of administratively defined alerts. EventLog Analyzer. Agree to the terms and conditions of the license agreement. 0000002669 00000 n
Do we require a Root password? If the files are piling up, kindly contact the support team. endstream
endobj
284 0 obj
<>/OCGs[298 0 R 299 0 R 300 0 R 301 0 R 302 0 R 303 0 R]>>/Pages 279 0 R/Type/Catalog>>
endobj
285 0 obj
<>/ProcSet[/PDF/ImageC]/Properties<>/XObject<>>>/Rotate 0/Thumb 83 0 R/TrimBox[0.0 0.0 612.0 792.0]/Type/Page>>
endobj
286 0 obj
<>stream
0000002234 00000 n
Cause: Cannot use the specified port because it is already used by some other application. EventLog Analyzer provides great value as a network forensic tool and for regulatory due diligence. HdWn$7VDQfr | `RUwm$,?,~>|VL? n|[i^'WkmQ#b-:^}dE]-kr]}rKqPx1fp;jk?d_/ka~FWo. During installation, you would have chosen to install EventLog Analyzer as an application or a service. Use the keytool utility to import the certificate into EventLog Analyzer's JRE certificate store. Before proceeding further, stop the EventLog Analyzer service and make sure that 'SysEvtCol.exe','Postgres.exe' and 'java.exe' are not running.There are 7 files that must be modified for IP binding. Enter the web server port. Note: You can also execute run.bat but this is not preferred. PDF Guide to secure your EventLog Analyzer installation Common issues while configuring and monitoring event logs from Windows devices. While adding device for monitoring, the 'Verify Login' action throws 'Access Denied' error. It can be fixed by copying the file regService.dll into C:\Program Files (x86)\EventLogAnalyzer_Agent. This error message can be caused because of different reasons. h?o0tb'chJAv(b0`jWoshJ,;t6W*ULHxH4r*iQ /H^@OBy.@pX BN$O8HdB C"cT7|-;9
n~g(o6N8OS^G'7Lm4%rrB|MV.>^NximC~ssAqA[8DNs]%:%>9jtlkeyl\`Oq|rV7[?ODevl^MAt5&GD7Od
u3-g_N\~ To fix this, add the required permissions by making SACL entries as below: Yes. Probably, this user does not belong to the Administrator group for this device machine. 4. 0000029080 00000 n
So if the agent's FIM logs have not been received, then the file events might not have been permitted by the audit service. If you cannot free this port, then change the web server port used in EventLog Analyzer. Monitor user behavior, identify network anomalies, system downtime, and policy violations. 0000009420 00000 n
This is a rare scenario and it happens only when the product shuts down abruptly during the first ever download of IP geolocation data. 0000002319 00000 n
Enter your personal details to get assistance. Frequently Asked Questions :: EventLog Analyzer - manageengine.eu So exclude ManageEngine installation folder from. Navigate to the Program folder in which EventLog Analyzer has been installed. Collect log data from sources across the network infrastructure including servers, applications, network devices, and more. To enhance the vents handling capacitye , a distributed EventLog Analyzer installation with multiple nodes can handle higher log volumes. Solution: This can be solved either by changing the port in the specified application or by using a new port.If you use a new port, make sure to change the ports in the forwarding device either manually or using auto log forwarding configuration. If not reachable, then you are facing a network issue. Probable cause 2: Log Files present in \data\AlertDump. mP(b``; +W. 0000013299 00000 n
We need to replicate the host all all 127.0.0.1/32 trust line with the new IP address in place of 127.0.0.1 and add it after that line. In case no logs are being received from the syslog device, please check for the following issues: In case the Log Receiver does receive the logs but the notification "Log collection down for syslog devices," is shown, please contact EventLog Ananlyzer technical support. Please make sure that the number of threads that an elasticsearch user can create is at least 4096 by setting ulimit -u 4096 as root before starting Elasticsearch or by adding elasticsearch - nproc 4096 in /etc/security/limits.conf. 283 0 obj
<>
endobj
296 0 obj
<>/Filter/FlateDecode/ID[<2C6812C00A93D3A38C6F6DC13E8C385E>]/Index[283 35]/Info 282 0 R/Length 75/Prev 446869/Root 284 0 R/Size 318/Type/XRef/W[1 2 1]>>stream
It is important for new threads to be created whenever necessary. Agent does not upgrade automatically. 0 Pd#
endstream
endobj
287 0 obj
<>stream
Refer to the Appendix for step-by-step instructions. Case 3: Logs are displayed in Wireshark but cannot be viewed in syslog viewer: If you are able to view the logs in Wireshark but you are not able to view them in syslog viewer, kindly contact the EventLog Analyzer support team. Linux: /bin/stopDB.sh file. Solution:In Solaris 10, the commands to stop and start the syslogd daemon are: In Solaris 10, to restart the syslogd daemon and force it to reread /etc/syslog.conf: # svcadm -v restart svc:/system/system-log:default. How do I fetch the FIM Reports from the console? No, logs can be stored is in the the EventLog Analyzer server only. p@8 S@Zp'PA`F-A@"X3xLaL` ?1o3,/HDNv)` Move the downloaded jar files to the following folders: <Installation dir>/Eventlog Analyzer/ES/lib If SysEvtCol.exe is running, check its firewall status column. The default port number is 8400. ManageEngine - IT Operations and Service Management Software If you want to install EventLog Analyzer 32 bit version: If you want to install EventLog Analyzer 64 bit version: chmod +x ManageEngine_EventLogAnalyzer.bin. Mentioned below are some issues that you might encounter while upgrading your EventLog Analyzer instance, and the steps to resolve them. " Note: If you monitor an application and also the server in which the application is installed, then you will be licensed for 2 log sources. 0000012024 00000 n
Audit is a default service present in Linux machines. The audit daemon package must be installed along with Audisp. SELinux hinders the running of the audit process with an error message that reads 'Access restriction from SELinux'. %PDF-1.3
%
Learn more about upgrading EventLog Analyzer here. Add a new entry giving the following permissions for 'Everyone'. The default port number is 8400. Installing the agent from the console results in "Installation Failed | Network Path Not Found" How can I fix this? This can also result in missing field information in the reports. Agree to the terms and conditions of the license agreement. OpManager monitors important server performance metrics . This error occurs when the SSL certificate you have configured with EventLog Analyzer is invalid. In the Management and Monitoring Tools dialog box, select. Check the extention for the attribute keystoreFile. FIM helps you monitor all changes made to files and folders in Windows and Linux systems including: Navigate to Reports and select the 'Devices' dropdown box on the top-left. If you are able to view the logs, it means that the packets are reaching the machine, but not to EventLog Analyzer. What are commands to start and stop Syslog Deamon in Solaris 10? Solution: Check if there are any files present in the folder \data\AlertDump. The agent is installed on a host which has neither a Linux nor a Windows OS. The drive where EventLog Analyzer application is installed might be corrupted. This can be done in the following ways: If reachable, it means there was some issue with the configuration. ManageEngine EventLog analyzer is licensed based on the number of log sources (devices, applications, Windows servers, and workstations) added for monitoring. How can this issue be fixed? If the required privileges are provided for the user to access the share, then this issue can be resolved. Open Conf/Server.xml file check for connector tag. 0000005820 00000 n
EventLog Analyzer provides default FIM templates for Windows and Linux devices. This error message signifies that the credentials entered are wrong. Alternatively, right click and select Properties. Ensure that the remote registry service is not disabled. Reason: Audit policies are not configured. %PDF-1.5
%
If the Oracle logs are available in the specified file, still EventLog Analyzer is not collecting the logs, contact EventLog Analyzer Support. PDF ManageEngine EventLog Analyzer ./Change\ ManageEngine\ EventlogAnalyzer\ Installation. wrapper.java.additional.21=-Djava.net.preferIPv4Stack=true, wrapper.java.additional.20=-Dorg.tanukisoftware.wrapper.WrapperManager.mbean=false. If you encounter any issues while taking a backup of EventLog Analyzer, please ensure that you take a copy of /logs folder before contacting support. Solution:Check whether System Firewall is running in the device. Refer to the section Secure log collection in A guide to configure agents for log collection in EventLog Analyzer to know more. Associated devices results in the error "Collector Down". trailer
<<0792E5222E3342E19E4F0598D677AB4F>]/Prev 234563>>
startxref
0
%%EOF
125 0 obj
<>stream
What should be the course of action? The device machine has to be reachable from the EventLog Analyzer server in order to collect event logs. 0000002551 00000 n
283 0 obj
<>
endobj
296 0 obj
<>/Filter/FlateDecode/ID[<2C6812C00A93D3A38C6F6DC13E8C385E>]/Index[283 35]/Info 282 0 R/Length 75/Prev 446869/Root 284 0 R/Size 318/Type/XRef/W[1 2 1]>>stream
Remove the Authenticated Users permission for the folders listed below from the product's installation directory. To check, execute the following commands. 0000001255 00000 n
Verify that you have applied the license file obtained from ZOHO Corp. Solution: Test the reason as to why the remote machine isn't reachable using wbemtest. 0000004698 00000 n
For replication, please copy this line itself and paste it in next line and then edit out the IP address. 0000009950 00000 n
Can I store any logs in the agent machine? hb```e``Z B@1V ``0!A gfPr:7h}!5\]'b@"ADCb1`AHs4AYYXXX%YC\\ <Installation folder>/EventLog Analyzer/Archive/. Ensure that the EventLog Analyzer server and the log source are in the same network and that the forwarded logs could not be blocked by firewall. How to register dll when message files for event sources are unavailable? If the reports for syslog devices are not populated with data, please check for the below reasons. File Integrity Monitoring (FIM) troubleshooting. The default installation location is C:\ManageEngine\EventLog Analyzer. Cause: HTTPS not configured to support TLS encrypted logs. To check , execute the command chkdsk from the folder. No connectivity with the agent during product upgrade. hb```f``A2,@AaS^X
&a3]V ', 'true'. The open keys and keys with sub-keys cannot be deleted. It might be due to network issues, proxy related issues, bad requests in the network, or if the URL is unable to locate a STIX/TAXII server. Open command prompt in admin mode. Note: If the default syslog listener port of EventLog Analyzer is not free then EventLog Analyzer displays "Can't Bind to Port " when logging in to the UI. Scanning of the Windows workstation failed due to one of the following reasons: Solution: Check if the login name and password are entered correctly. After this error occurs, a built-in script file will run to increase the allocated heap used by EventLog Analyzer and the product will restart on its own. Yes. Java Virtual Machine can hang when it doesn't receive the required amount of CPU time. Ensure that the default port or the port you have selected is not occupied by some other application. Problem #5: Remote machine not reachable. A standalone installation of EventLog Analyzer can handle an average log rate of 20,000 EPS (events per second) for syslogs and 2,000 EPS for event logs. prerequisites applicable for EventLog Analyzer, Using Microsoft System Center Configuration Manager (SCCM) or some similar software deployment tool (applicable only for Windows agent), A guide to configure agents for log collection in EventLog Analyzer, MS IIS - Web Server/ FTP Server Log Monitoring, Privilege User Monitoring and Auditing (PUMA) Reports, Privilege User Monitoring and Auditing (PUMA), SharePoint Management and Auditing Solution, Integrated Identity & Access Management (AD360), Microsoft 365 Management & Reporting Tool, Comprehensive threat mitigation & SIEM (Log360). )~lqw_SLhSArkWu5t+99=&%?AC1|
o..\6qwZB@Zf[djx~8(<9L
-E=NN&NlNA '"t>,oCts6e=q!qTwfl2O)]7?L6X5eW0qCoH090hJ EventLog Analyzer displays "Port 8400 needed by EventLog Analyzer is being used by another application. Binding EventLog Analyzer server (IP binding) to a specific interface. What could be the possible reasons? Connection failed. Before installing EventLog Analyzer, make the installation file executable by executing the following commands in Unix Terminal or Shell. Probable cause: You do not have administrative rights on the device machine. 0000001512 00000 n
PDF EventLog Analyzer Requirement Guide - ManageEngine Check the details you had provided for both Mail and SMS settings. Probable cause: The transaction logs of MS SQL could be full. hbbd``b`AD H @ l+%$Lg`bd\d100-@
&
endstream
endobj
startxref
0
%%EOF
317 0 obj
<>stream
Remove the # from the line, it should now look like, The next line from current position should be, Add the following parameter in the line in any place before. If the firewall rule has been added and the logs are still not coming, disable the firewall and check again. Specify the port details. If you want to install EventLog Analyzer 64 bit version in Windows OS, execute ManageEngine_EventLogAnalyzer_64bit.exefile and to install in Linux OS, execute ManageEngine_EventLogAnalyzer_64bit.binfile. Ltd. 5 Overview Get log data from systems, devices, and applications Search any log data and extract new fields to extend search Get IT audit reports generated to assess the network security and comply with regulatory acts Get notified in real-time for event alerts and provide quick remediation