How to monitor specific event IDs in UIM

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

How to monitor the following Event IDs?

 

- Event ID 7036 (System Log): AD DS Service unexpectedly stopped or entered a suspended state.

- Event IDs 1083 & 1061 (NTDS Replication): These indicate replication conflicts (e.g., LDAP error 8438), which can occur when an attacker is modifying objects simultaneously with legitimate replication.

- Event ID 1173 (NTDS General): Internal database error. A high frequency of this can indicate tampering or imminent corruption.

Environment

UIM 23.4.7

ntevl 4.36

Resolution

To monitor specific event IDs in UIM, you deploy and configure the ntevl (NT Event Log) probe on your target Windows servers. This probe monitors the event logs and generates alarms in the CA UIM Operator Console when configured thresholds or matches are met.

1. Here is the step-by-step process to set up event ID monitoring:

 1. Configure the ntevl ProbeOpen your CA UIM Admin Console or Infrastructure Manager.
 2. Deploy the ntevl probe to the specific server or robot requiring monitoring.
 3. Open the probe's GUI/Configuration window.
 4. Under the Properties tab (or Available Log Files), verify your target log file (e.g., Application, System, or Security) is selected.

2. Set Up the Monitoring Profile

 1. Create a new monitoring profile within the ntevl probe.
 2. Define the exact Event ID(s) you wish to monitor under the rule/profile matching criteria.
 3. Specify severity levels (e.g., Major, Critical) for the resulting alarms.

3. Monitoring Custom Event Logs (Optional)If your targeted event logs (such as the Microsoft Task Scheduler operational logs) do not fall into the standard Application/System/Security    lists, you can specify them:

 1. Right-click the ntevl probe and select Raw Configure.
 2. Add the custom log path under the Logs section (e.g., Microsoft-Windows-TaskScheduler/Operational).