Overview Guide › Windows Agent Deployment › Create a Connector Based on NTEventLog

Create a Connector Based on NTEventLog

After installing an agent, you create a connector to specify the event sources for the events you want to collect. Since you installed an agent on a server with a Windows operating system, you create a connector based on the NTEventLog integration and specify settings for the WMILogSensor as described in the connector guide you open from the New Connector Creation wizard. You specify the name of the host on which the agent is installed for agent-based log collection. Optionally, you can add another WMI log sensor for this connector and specify a host other than the one where the agent is installed. This enables agentless log connection. The additional host or hosts must be in the same domain and have the same Windows administrator as the first host you added.

To configure a connector based on NTEventLog

1. Maximize your browser displaying the CA User Activity Reporting Module Agent Explorer.
2. Expand Agent Explorer and then expand the Default Agent Group.

   The name of the computer where you installed the agent appears.

   

3. Select this agent.

   The Agent Connectors pane appears.

4. Click Create New Connector

   

   The New Connector Creation wizard appears with the Connector Details step selected.

5. Leave Integrations selected, and select NTEventLog from the Integration drop-down list.

   The Connector Name and Description fields are populated based on the selection of Integration.

6. Edit the connector name to make it unique. Consider extending this name with the target server name, for example, NTEventLog_Connector_USER001LAB.

   

7. Select the Connector Configuration step.

   

   The Sensor Configuration pane appears with a Help button to the Connector guide for NTEventLog, which provides help on the fields for sensor configuration.

   

8. Click the display details button for WMI sources.

   

9. Configure the WMILogSensor settings for the local computer for agent-based log collection. Click the Help link for details.

   The following example shows a configuration where the user is a Windows administrator on the specified WMI server. The domain is for the WMI server.

   

10. (Optional) Configure a WMI sensor for a different computer for agentless log collection using this same connector.
    1. Click the repeat super node button.

       The following illustration shows a configuration with two WMI sources.

    

    1. Configure the WMILogSensor settings for another computer.

    The following example shows a configuration for a second WMI log sensor in the same domain and with the same administrator credentials.

    

11. Click Save and Close.
12. To view the status of the connector you configured, do the following:
    1. Select the agent in the left pane.
    2. Click Status and Command.
    3. Select View Status of Connectors.

    The Status Details pane appears.

    

13. Click the Running link.

    The displayed status of the target configured in the connector includes the CPU percentage, memory usage, and average events per second (EPS).