1

Is there a free Windows based Log manager that can be installed on a Windows Workstation that allows me to pull all the logs from Windows workstations/servers?

The idea is to monitor events across the company and 5 remote sites; and once the resolution is verified; apply the fix on the affected machines using our in-house RMM.

10 Spice ups
2

Check out Sysinternals, there are multiple options.

3 Spice ups
3

This is sort-of built in to Windows. It takes some setup, and I’ve never used it on client machines, only servers, but most RMM tools also have built-in utilities for grabbing event logs as well.

If you haven’t went down this particular rabbit hole, this page and this page might be useful. The first link is specifically about setting up event collection, and the second is more general information about the Windows Event Collector and links out to more specifics.

2 Spice ups
4

Josh,

Thanks for the tip. I use Sysinternals for quite some time. I don’t recall any utility Mark published that would aggregate events from all the machines. I don’t recall the name of the open source software I discovered about 2016ish; it was a scheduled ‘pull’ method to go the machines and get the logs. It used AD Authentication to pull logs from devices; and aggregate the events in it’s own data base. Once I found a resolution to an event, and resolve it, I would refer back to the software to determine which machine had the event. For example, if 12 PCs had lost secure connection to the domain, I had the ability to find out which 12 domain PCs had the issue; and needed to be re-joined to the domain.

2 Spice ups
5

Check out ELK Stack (Elasticsearch, Logstash, Kibana) it’s a game-changer for managing logs across a diverse environment.

Elasticsearch makes it insanely fast to search through millions of logs. Whether it’s a failed login, a service crash, or a weird network spike.

Kibana lets you build dashboards that actually make sense to non-IT folks. You get real-time views of system health, login trends, system logs, etc.

Logstash (or Beats) can ingest logs from just about anything—Windows, Linux, firewalls, apps, you name it.

Everything lands in one place. No more RDPing into 10 servers to check logs. It’s all searchable, filterable, and alertable. Plus, it’s Open Source and Scalable. It has made my life a lot easier.

1 Spice up
6

I have been hovering around Logging Made Easy setup that CISA has available. Though I have not implemented myself, it is something I want to at least try…

You first!

2 Spice ups
7

I know you said “Free,” but I thought I’d make a plug for ManageEngine’s EventLog Analyzer. It works pretty good and is not very expensive. We licensed 8 devices for less than $500/yr. It uses the ElasticSearch mentioned above.

2 Spice ups
8

James, so far, that is the best solution I have found. Thank you. It is a bit frtizy; not always works; over time, I have to refresh it. But, not bad since I have not found a good solution yet. appreciate it.

2 Spice ups