In the Configure SNMP and WMI for Windows section of Chapter 2, Discovering Devices we discussed setting up Windows Management Instrumentation (WMI). If WMI is not yet installed, take a few moments to review the instructions in Chapter 2, Discovering Devices.
Unlike syslog, which logs messages directly to a remote host, Zenoss Core has to connect to the Windows server to pull entries from the Event Log—at least that's the default behavior we will explore in this section. There are third party applications that will log Windows event logs to remote syslog servers such as Zenoss Core. This allows zensyslog to process the messages, and you could use event mappings to make sure the events from the Windows server get associated with an appropriate event class.
If you have a Windows server available, open it in Zenoss Core so we can configure Event Log monitoring:
From the devices page, select Add WinService from the Add Component menu.
In the Add WinService dialog box...