OneSight Administrator Guide

Configuring Event Log Monitors
Time Since Last Modified – Returns the time since the log was
last modified.
The following additional fields are displayed when you select a
metric type of Perl Expression or Number of Matching Records.
Perl Expression – Enter the Perl Expression to use to parse the
results.
Match if NT Even Source is – Filter based on NT event source.
Separate multiple sources with a comma.
Match if NT Event ID is – Filter based on NT event ID. You can
enter one ID, multiple IDs separated by commas, or a range of
IDs. For example, ―1‖ or ―1,2‖ or ―1,2,7-10‖
Match if Category is – Filter based on category. You can enter a
list of strings or a list of number ranges separated by commas.
Match if Username is – Filter based on Username. You can enter
a list of strings separated by commas.
NT Event Type – Select the type of NT event you want to
monitor. If no type is selected, all event types are monitored.
String Mappings – Displays the String Mappings dialog box for
specifying string mappings. This button is only available when
you select a metric type of Perl Expression.
String Mappings – OneSight collects numeric performance
data. If you are measuring an NT event log response that is a
string, it can be converted to a number for use in OneSight
by using the String Mappings field. Simply specify a
semicolon delimited mapping of Strings to Integers. For
example, ―false=0;true=1‖; will convert a ―false‖ reading to
a 0 value in OneSight, and this will be displayed in OneSight
Status as ―false=0‖. If you only want to display the string on
the OneSight status page, use a colon, rather than a semicolon
to delimit the values.
244 OneSight Administrator Guide