Configuration

Use this section to configure how EventReporter collects Windows events, processes them through rules, and stores or forwards the results.

If you are new to the product, start with Getting Started for the first working setup and return here for the detailed configuration pages.

In this manual, input is the clearest plain-language concept for anything that collects events, while service remains the operational term for the configured EventReporter object.

• Configuring EventReporter
  • The tree structure
  • How configuration changes take effect
  • Defaults versus instances
  • Services
  • Rulesets, rules, filters, and actions
• Client Options
• Client Tools
  • Syslog Test Message
  • Passive Syslog Receiver
  • Network Discovery
  • Kill Service
  • DebugLog
• Using File based configuration
• General Options
  • License
  • General
  • Debug
  • Engine
  • Queue Manager
• Core concepts
  • Concept map
  • Canonical concept pages
  • Why this matters
• Services
  • Important behavior
  • Service types used in EventReporter
• Filter Conditions
  • Why filters matter
  • Important behavior
  • Example
  • Detailed filter references
  • Basic filters
  • Event log monitor filters
  • Custom properties
• Actions
  • Important behavior
  • Storing actions
  • Forwarding actions
  • Internal actions
  • Other actions
• Multiple RuleSets - Rules - Actions