Overview
By default, GFI EventsManager collects the last 2000 Windows Events generated on the target computer.
This article explains the process of customizing the number of Windows Events collected from a target machine.
Process
To customize this default value:
GFI EventsManager 8 and newer
- Open Control Panel > Administrative Tools > Services.
- Stop the GFI EventsManager service.
- From Windows Explorer, browse to the <ESMInstallDir>\Data\Settings\ESM Settings folder.
- Locate the file Advanced Settings.xml.gz and double-click on it to extract the XML file.
- Open the XML file Advanced Settings.xml.gz using Notepad or any other text editor.
- Change the value of LastNEvents to the value you want. If it is set to 0, EventsManager will collect all the events.
- Click Save and close the file.
- You then need to re-zip the file in gz format.
- Start the GFI EventsManager service.
GFI EventsManager 7
- Open Control Panel > Administrative Tools > Services.
- Stop the GFI EventsManager service.
- From Windows Explorer browse to the <ESMInstallDir>\Data folder.
- Open the XML file toolcfg_setting.xml using Notepad or any other text editor.
- Change the value of LastNEvents to the value you want. If it is set to 0, EventsManager will collect all the events.
- Click Save and close the file.
- Start the GFI EventsManager service.