---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Windows event log filter parameters

# Windows event log filter parameters {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The configurable values on the Check Parameters tab of the os.windows.check-event-log check.
{#windows-event-log-parameters-tab__table_ylr_rzv_mxb__entry__3}

| Parameter | Type | Description |
|-|-|-|
| provider_name | String | Name of the provider that generated the event. Note: If you do not specify a log_file value together with the provider_name, the system searches all available log files, which increases the time it takes to receive results. |
| log_file | String | The name of the Windows event log file from which you retrieve events. Possible values are: * Application * System {#windows-event-log-parameters-tab__ul_g5c_ccw_mxb} Note: If you do not specify a provider_name value together with the log_file, the system searches all events from the log file, which increases the number of retrieved events. |
| id | Integer | The numerical id of the event. Possible values are 0-65535. |
| warning | Integer | Any value above the specified parameter generates a Warning event. |
| event_level | String | The severity level of the event. Possible values: * Critical * Error * Warning * Information * Verbose {#windows-event-log-parameters-tab__ul_atq_2gw_mxb} |
| regex_pattern | String | The regex pattern to be used in searching the event logs. The value must be enclosed in double quotation marks. For example, "error". |
| duration_hour | Integer | The time period for which you want to retrieve events from the Windows event log. Value is specified in hours; fractions of hours are specified with decimals. |
| critical | Integer | Any value equal to or above the specified parameter generates a Critical event. |
[Table 1. Check Parameters tab values]

{#windows-event-log-parameters-tab__table_ylr_rzv_mxb}