Windows Event Logs

December 13, 2009

Over the last few months the CFEngine AS development team has added better integration for CFEngine Nova with windows (without need of Cygwin). The most recent development is support for Windows event logs. Event logs are the Windows counterpart to syslog from Unix. The main difference is that event logs aim to group similar log messages, giving each group an event id.

A program that creates logs, such as CFEngine Nova, must define the possible event ids, and their meaning. In many applications, only one event id is defined, a generic log message. However, CFEngine Nova defines the following range of event ids, which allows for automatic handling of log messages.

Description Event ID Type
Promise kept 100 Information
Promise repaired 101 Information
Promise not repaired due to warn only policy 102 Error
Promise not repaired due to error 103 Error
Report promise 104 Information
Generic information 105 Information
Generic verbose 106 Information
Generic warning 107 Warning
Generic error 108 Error

The Nova event logs can be found under the “System” logs. Almost all monitoring products for Windows supports reading event logs, and they can thus monitor logs from CFEngine Nova as well. This makes it possible to do more advanced querying on the status of a machine running CFEngine Nova, e.g. to show all promises that have not been kept in a certain time interval. However, we recommend using the Knowledge Map to do more advanced things, as it is specifically made for this purpose and supports all operating systems that CFEngine runs on.

Promise repaired in Event
Viewer

Promise not kept in Event
Viewer