Overview

This article provides useful information about changing the error levels of the GFI Audit Events.

Information

GFI EventsManager Audit Events show Error or Warning in the source computer's Application Event Log and when collected by GFI EventsManager may then be listed as critical events. You may be aware of these failures and you may not consider them as problems, but we are concerned that they may cause a visiting auditor to question them.

When GFI EventsManager runs audit checks on the target machine, it will add an event to the target computer's Application Event Log if the check finds a problem with the condition it is checking for. The source in the event will be GFI EventsManager. The event GFI EventsManager and the event Type field ("Level" field for Win7/Vista/2008 machines) will be set to an appropriate type of success as Error or Warning. This cannot be changed.

GFI EventsManager then collects the event and triggers a rule that causes the events to be put into the database. This rule can be edited to change the classification to a lower level. Therefore, the events will no longer be classified as critical. All the rules are located in Configuration > Event Processing Rules > Windows Event Logs (log type) under the GFI Rules rule set.