---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/it-operations-management

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Enable log monitoring in a Windows environment

# Enable log monitoring in a Windows environment {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 Minuten Lesedauer

To enable monitoring logs in a Windows environment, select the relevant policy and
assign specific check parameters to the policy. When log monitoring is enabled and a
specified string is discovered in the log being monitored, the system creates an
event.

## Vorbereitungen

Role required: agent_client_collector_admin

## Prozedur

1. Navigate to AllAgent Client CollectorPolicies.
2. Select the Windows log monitoring policy.
3. On the Check Instances tab, select os.windows.check-log to enable monitoring Windows log files.
4. On the Check Parameters tab, specify the log parameters to be monitored by the check, as described in the following table:  
   {#acc-enable-log-monitoring-windows__table_qp2_vht_44b__entry__2}

   | Name | Value |
   |-|-|
   | warning | Number of times the specified pattern strings are found in the log which generates a warning event. Default = 1. For example, if the pattern value is Exception and one Exception event is located in the log, a warning event is generated. |
   | critical | Number of times the specified pattern strings are found in the log which generates a critical event. Default = 2. For example, if the pattern value is Exception and two Exception events are located in the log, a critical event is generated. |
   | file | Location of the log file. |
   | pattern | Strings which are being searched for in the log. Default values are Severe and Exception. Other possible values include 404 and Error. Ensure that you separate multiple patterns with a pipe (\|) and pass it as a parameter inside quotes. For example: `"SEVERE|404"`. |
   [Tabelle : 1. Check parameters]

   {#acc-enable-log-monitoring-windows__table_qp2_vht_44b} {#acc-enable-log-monitoring-windows__table_dmh_1zx_ssb__entry__2}

   | Name | Value |
   |-|-|
   | warning | Number of times the specified pattern strings are found in the log which generates a warning event. Default = 1. For example, if the pattern value is Exception and one Exception event is located in the log, a warning event is generated. |
   | state_dir | Directory which stores the location in the log where the most recent log reading stopped. When the log reading resumes, it begins from the location indicated in this file, instead of starting again from the beginning of the log. |
   | critical | Number of times the specified pattern strings are found in the log which generates a critical event. Default = 2. For example, if the pattern value is Exception and two Exception events are located in the log, a critical event is generated. |
   | file | Location of the log file. |
   | pattern | Strings which are being searched for in the log. Default values are Severe and Exception. Other possible values include 404 and Error. Ensure that you separate multiple patterns with a pipe (\|) and pass it as a parameter inside quotes. For example: `"SEVERE|404"`. |
   [Tabelle : 2. Check parameters]

   {#acc-enable-log-monitoring-windows__table_dmh_1zx_ssb}