Censusby Steward IT

Documentation › Using Steward IT Census

Event logs

Steward IT Census reads the errors from your computers' event logs after each inventory, so problems such as crashing services, disk errors and unexpected shutdowns are visible in one place, without logging in to each computer.

Open Assets › Event log for all computers, or the Event log tab of an asset.

What is collected#

  • Windows: error and critical entries of the System and Application logs (change the logs, or add warnings, under Scanning › Event logs), plus specific events of any level that you list, such as Security 4740 (account locked out, on domain controllers) or System 1074 (who restarted the computer).
  • Linux: the systemd journal, priority error and worse (and warning if you add warnings).
  • macOS isn't read.

Collection needs the Census agent 0.40.0 or later, or a WinRM or SSH scan. It runs as a separate step after the inventory, so a slow event log never costs the inventory. Each collection reads the last 72 hours (newest 500 entries); Census keeps each entry once, for 30 days.

Settings#

Under Scanning › Event logs (administrators):

  • Read event logs: turn collection off entirely.
  • Windows logs to read errors from, and Also warnings.
  • Linux: systemd journal on or off.
  • Look back and Max. entries per collection (the newest are kept): how far back each collection reads. Make the look-back longer than the time between inventories (the Census agent reports every 4 hours by default; scans run on their schedule).
  • Keep entries for: older entries are deleted by the daily cleanup.
  • Specific events of any level: log name, event ID and a description (your own note, e.g. what the event means; it stays on the server). ＋ Add event adds a row, ✕ removes one. System 6008 (unexpected shutdown) is there as an example. It's an error, so it's also collected while System is in the logs above; rows matter most for events that aren't errors, like Security 4740 or System 1074.
  • Ignore: sources (and event IDs) that are never stored, each with a description too. Microsoft-Windows-DistributedCOM 10016 and 10010 are ignored by default (remove the rows to collect them): they are harmless and appear on almost every Windows computer.

Using the entries#

  • Most frequent groups the entries of the last 24 hours, 7 or 30 days by source and event ID, with how many computers had them. Click a row to see the entries.
  • All entries lists entries with filters for text, level, event ID and period.
  • Reports (category Event log): Most frequent error events, Assets with the most error events, Unexpected shutdowns and crashes (Kernel-Power 41, EventLog 6008, BugCheck 1001).
  • Alert Event log entry (Configuration › Alerts & scheduled reports): emails new entries matching event IDs, a source, message text and a minimum level, for example every account lockout (Security 4740) once you've added that event above.