ELM Enterprise ManagerELM Core License

Change Monitoring from “What Happened” to “What’s Happening”

The Windows operating systems publish volumes of information on its health and status. The event logs, performance metrics and process/service states are all available in real time. Unfortunately, these sources are distributed into a variety of locations and without a Windows Server Monitor, are only used in forensic investigations

The Windows Server Monitor, ELM Enterprise Manager-Core Licenses, provides real-time Event Log Management and Window Server performance and status monitoring, alerting and reporting.

For the details, select from the buttons below:

Windows Server Monitor Item Icon in ELM Enterprise Manager.Windows Server Monitoring

The Core License in ELM Enterprise Manager takes advantage of many of the same tools System Administrators use to investigate security threats or declining performance. Instead of having to review a server health and status locally, the ELM Windows Server Monitors detect changing conditions and display the information in the central ELM Management Console or Dashboard.

The Windows Server Monitor Features in ELM Core Licenses include:

Event Collector for Windows Server Monitoring Event Collector Real-time event collection from any Windows event log complete with message details.
Performance Collector for Windows Server Monitoring Performance Collector Scheduled collections of any published performance counter/object/instances.
Windows Server Performance Monitor Icon for ELM Enterprise Manager. Performance Monitor Tests performance objects, counters or instances against >,=, or < conditions.
Windows Service Monitor icon in ELM Enterprise Manager Service Monitor Detects changes in a service status. (Running, Paused, and Stopped)
Process Monitor for Windows Server Monitoring Process Monitor Monitors for new processes failed processes and CPU thresholds.
File Monitor for Windows Server Monitoring File Monitor Scans for specified character strings in files and directories.
Ping Monitor for Windows Server Monitoring PING Monitor Automates a PING process and monitors for nine different status changes.


Automate Windows Server monitoring with ELM Enterprise Manager and be the first to know.


ELM Enterprise Manager icon for Alerting is a lighting bold.Alerts

Receiving an alert is a critical function of proactive Windows Server management. Not only must the notification be launched iin real-time, it must be flexible enough to be useful under a variety of conditions.

In the ELM Core Licenses, the notifications can be combined or reused under multiple triggers. They can be activated during specific times and on specific days. In addition, barrage protection features are available to defend against rapid fire alerts and routine notification of non-threatening conditions.

The most commonly used Notification Methods include:


Email Notification for a Windows Server Monitor Email:

SMTP mail can be configured to include valuable information about the events that trigger them.  The email message can deliver all or part of the event data and be customized with comments or descriptions.


Windows Event Log Monitoring Dashboard Notification Red Diamond Icon posted in the ELM Dashboard. Dashboard Notification:

The Dashboard Notification posts visual alerts to the ELM Dashboard. A Green Circle (1-3), Orange Triangle (3-6) or Red Diamond (7-9) can be displayed depending on the priority assigned to the triggering event.

There are two Status conditions in the ELM Dashboard.  The Current Status displays the last alert received at the Dashboard and the Peak Status is the highest priority alert received since it was last manually cleared.


Ping Monitor for Windows Server Monitoring Event Forward:

The Event Forward Notification option leverages the fault tolerance and encryption technologies used in Agent-to-ELM Server communication and applies it to ELM Server-to-ELM Server data transfer. This provides the technologies for a reliable n-tier architecture and is used to support scalability and security requirements.


ELM Advisor Desktop Notification for Windows Server Monitoring Desktop Notification:

The ELM Advisor is a proprietary real-time Notification Method.  Located in the Windows Taskbar Notification Area, the ELM Advisor icon indicates when an alert has been received and delivers the event information as a pop-up message.  The data is also presented in an event list.  With the ELM Advisor, event activity from across the network can be monitored from a Systems Administrator’s workstation.


Command Script Notification for Windows Server Monitoring Command Script:

Taking alerting to the next level, Command Scripts can be triggered as a real-time notification option.  They can be used to write Helpdesk tickets, take immediate security actions, or trigger an out-of-band wireless text message.


When a critical event is written to a remote server, the ELM Enterprise Manager Core License has the tools to ensure System Administrators receive the information in real-time.


Windows Server Monitor Reports icon in ELM Enterprise Manager.Reports

With the performance and event data collected and stored in a database, reports can be generated that uncover trends and document security issues. These reports can be delivered by email in PDF or CSV formats and saved to a specified file location.

Event Views - Event Log Management and MonitoringEvent Reports Event Audit Failure - Event Log Management and MonitoringSecurity Audit Reports: Windows Server Performance Monitor Icon for ELM Enterprise Manager.Performance Reports:
Events Summary Account Management Activity Bottleneck Reports
Events by Source Computer Management Activity Server Performance Reports
Events by Type Logon Activity Application and OS Inventory
PCI-DSS Compliance Object Access Process Performance Report
Privilege Use
Group Policy


Centralizing event logs and performance data with ELM Core Licenses provides a reliable data source for performance, security and compliance reporting.


 Event Log Management and Monitoring - Data StorageData Storage

For reliability and responsiveness in the Windows Server Monitor, ELM supports three (3) non-proprietary databases.

The Primary Database stores the most recent event, performance, SNMP and Syslog data.

The Failover Database prevents loss of monitoring and alerting while the Primary is unavailable or under nightly maintenance.

The Archive Databases store long-term data for the support of compliance mandates and security policies.

In new deployments, ELM Enterprise Manager is configured to use the MS SQL Server run-time databases included in the product download. These databases will support most testing, low volume, and monitoring/alerting applications.

For high event volume environments, a user-supplied Microsoft SQL Server 2008 or later is recommended.

ELM Enterprise Manager uses three Microsoft SQL Server Databases to support automated event log management and Windows Server Monitoring.

ELM Enterprise Manager includes fault tolerance features ensuring real-time alerting and data reliability.

More Info


Windows Server Monitor Performance Bottleneck Trend IconDashboard-Status and Performance

The ELM Enterprise Manager-Core License includes the Windows Server Monitors to display a server’s status and performance. These Monitors include the Event Collectors and a special set of default Performance Collectors.  Together they provide the data to support the alerting and trending displays in ELM Dashboard.

To indicate a server’s status, the dashboard displays two conditions.  The Current Status is the last alert posted by the Dashboard Notification Method.  Depending on configuration, it can display one of three brightly colored icons that are divided into a 1-9 priority scale. The highest priority Current Status is elevated to Peak Status that persists until it is updated or is manually cleared.

For Windows server health monitoring, sparklines display the most critical Bottleneck values for the Processor, Memory, Disk, Free Disk and Network performance metrics. These Bottleneck values are calculated from a selected set of weighted and normalized objects/counters/instances.  When these values exceed a threshold, they turn red indicating the time and severity of the performance threat. This innovative display also provides a performance comparison across all monitored Windows servers.

ELM Dashboard with event log status display and Windows server performance trends.

Click to expand ELM Dashboard.

The ELM Dashboard provide status and performance of a Windows server at the Speed of Sight.


Event Views for Proactive Windows Server MonitoringViews and Notification

With a Windows Server Monitor, a handful of meaningful Windows events are buried in the millions that stream in each day. The challenge is stripping through the chatter and displaying only the informative events.

ELM Core License satisfies this critical objective with three display options, or Views. When an incoming event satisfies a set of Exclude Filters and Include Filters, it is inserted into the View. This provides a focused display of related events. In addition, each new event will trigger the notification options assigned to that View.

The three View Options are:

Windows Event Views

The Event Views lists the selected events in real-time. The Time, Type, ID, Computer and the complete Message Detail are all presented for each event. A Pause is available to stop the scrolling during event storms and the Summary aggregates events to assist in identifying the noise.

Security Views

The Security Views expand beyond the Event Views to include important security data buried in the event message. It includes sortable columns that include Category, User Name, Domain, Workstation and Logon Type


Correlation Views

The Correlation Views display event sequences. When a specified “Start” event is found, it is listed in the View and the related “End” Filters are activated. A Match is determined when both the Start and End criteria are satisfied within a defined period. Both events are displayed in the Matching View. A Time-Out View displays a Start Event when a matching event is not found before the clock expires.


Strip through the event noise and chatter with ELM Enterprise Manager Filtered Views


Checkbox icon indicating the extra features in ELM Enterprise Manager. Extra Features In the Windows Server Monitor

Event Filters for Event Log Management and MonitoringEvent Filters

  • Custom Built Filters
  • Event Specific Filters
  • White & Black List Filtering
More Info


Point to Point Verification for Event Log Management and MonitoringPoint-to-Point Verification

  • Monitoring of Heartbeat Events
  • Alerts Confirming Success
  • Alerts Confirming Failure
More Info


Non-Windows Support FeatureNon-Windows Support

  • Syslog Receiver and Alerting
  • SNMP Trap Receiver and Alerting
  • Unified Event Log Format
More Info


Maintenance Windows for Event Log Management and MonitoringMaintenance Windows

  • Disable/Enable Notifications
  • Reoccurring Schedules
  • Eliminate False Alarms

More Info

Windows Server Performance Monitor Icon for ELM Enterprise Manager.Server Performance

  • Dashboard Bottleneck Sparklines
  • Performance Threshold Monitor
  • Scheduled Performance Reports

More Info

Agent Communication for Event Log Management and MonitoringSecure Communication

  • Firewall Friendly
  • Two Listening Ports
  • 128-bit Encryption

More Info


Put a check mark in all the boxes, ELM Enterprise Manager includes all the tools for efficient Windows Server Monitoring