User guide

44
Key Name
Description
Valid Values
event-log
The name of a Windows NT Event log to monitor.
Each event is sent to LCE as a new log.
Any NT event log name, or, “all” will
monitor all NT event logs at the time the
client is started.
flat-file
The full path and name of a text file to monitor. Each
new line is sent to LCE as a new log.
Any fully qualified path and file name,
with the file extension. It is best practice
to escape folder separators with a
backslash.
flat-file
Sub Key
Description
location
The full path of which to monitor text files. Each new line in each file is sent
to LCE as a new log.
include
Optional sub key. Files at “location” will only be monitored if they match
this pattern. Wildcards are allowed.
exclude
Optional sub key. Files at “location” will NOT be monitored if they match
this pattern. Wildcards are allowed.
delete-on-
size-bytes
Optional sub key. Files at “location” will be deleted once they reach the
size specified in this key (in bytes). Optional letters can be post-fixed to
change the multiplier (K for kilobytes, M for megabytes, or G for
gigabytes). This option was added specifically for Exchange log files,
which can grow unbounded.
EXERCISE CAUTION AND DISCRETION with this option - the LCE Client
will attempt to delete log files above a certain size with this option.
If “flat-file” holds sub-keys, then “location” is the fully qualified path and file name. The other sub
keys apply ONLY to the files monitored at this specified location.
interval-log-
seconds
The number of seconds between scanning logs
watched with “flat-file”.
A non-zero integer
tail-
subdirectories
Whether or not to follow subdirectories given in “flat-
file” and “flat-file” “location” values. Setting this to “1”
when watching large directories with no
include/exclude filters (like C:\\Windows) may impact
performance.
0 or 1
(0=off,1=on)
monitor-file
The full path and name of a file to monitor. If the file
changes, the old and new MD5 checksums are sent
in an event to the LCE server.
Any fully qualified path and file name,
with the file extension. It is best practice
to escape folder separators with a
backslash.
monitor-file
Sub Key
Description
Valid Values
location
The full path at which to monitor
binary files. For each file that
changes, the old and new MD5
checksums are sent in an event to
the LCE server.
Any fully qualified path and file name,
with the file extension. It is best
practice to escape folder separators
with a backslash.