ELM Enterprise Manager includes a powerful reporting engine, ELM Editor. Though you may have certain reports scheduled to run on a regular basis, from time to time the need arises where you need to create a report quickly or on the fly. In this article we’ll show two ways to accomplish this with ELM Editor.
For this example we’re going to start by taking a look at an Event View, specifically the Audit Logon Failure Events View. As we scan through here, say you want to narrow down and take a look at the instances of “BadUser” that are showing up in this View.
To do that we’ll quickly modify the Include Filters for this view to look for “BadUser” in the Message Contains field.
Now our View is only showing the events associated with “BadUser.” Deciding we want to make a report of this to distribute there are a few options that can make that happen quickly and easily.
Option one is to right click on the View and select “New Custom Report” from the menu. This will automatically create a new custom report under the ELM Editor container and give the report the name of the view it came from. It’s as simple as that. You will most likely want to then go in and modify the layout of the report to your liking but before we do that let’s take a look at Option two.
Another very slick feature with ELM Enterprise Manager is the ability to drag-and-drop Views to create reports. To accomplish this we’ll highlight the ELM Editor folder under the Reporting container so the contents appear in the right pane of the console. Now we’ll simply drag the Audit Logon Failure Events View from the left pane to the right pane and Presto! a new report is created.
This new report inherits all of the settings from the View it was generated from. In previous versions of ELM the report would default to a one week timeframe so further modification of the report may have been necessary to get the timeframe you wanted. However in ELM Enterprise Manager 6.X and above, the report generated maintains all of the View settings so what you see is exactly what you get.
Now we’ll drop down to the ELM Editor container, highlight our new report, and hit the F2 key so that we can rename the report accordingly to what it is displaying – in this case “Audit Logon Failures BadUser” is what we’ll call it.
Next we’ll right click in the header of the report and choose Edit > Properties to modify the layout.
Within the ELM Editor reporting tools we’ll change the layout or style from a RowGrid (default) to a SummaryGrid, and click Ok when we’re done. This will make our new report easier to view.
Now you can see the full Audit Logon Failure BadUser report that was just created in Summary Grid fashion. All of the event information is easy to read and all instances can be scanned through quickly.
Right clicking at the top section of the report you can quickly fire it off to an email address or choose to schedule it. If it’s a one time use you may just delete it upon completion.
One thing to note; if you modified the Filters of an existing View for the report just created, as we did in this case, you will want to go back in to the Filters of that View again and reverse out the changes you made.
We hope that you found this article on How to Quickly Create a Custom Report From an Event View useful and wish you continued success with ELM.