Info

License: Free — part of the universal collection tier.

Warning

Windows only. The probe subscribes to channels through the Windows Event Log API. On Linux and macOS it reports a clear not supported on <OS> error at start and stays inert — the same configuration file can ship to a mixed fleet.

Windows Event Log Probe

The windows_eventlog probe subscribes to Windows Event Log channels — System, Application, Security, or any operational channel (Citrix, FSLogix, ...) — and ships each event as a structured OTel log record through the OTLP storage. Filtering by level, EventID and provider happens at the agent, so only the events you asked for leave the host.

Quick start

# probes.d/10-windows_eventlog.yaml — each file under probes.d/ is a YAML array of probes
- name: windows-events
  type: windows_eventlog
  params:
    channels: [System, Application]
    levels: [Critical, Error, Warning]
    bookmark_path: 'C:\ProgramData\senhub-agent\eventlog.bookmark'

Parameters

Parameter	Must set	Default	Description
channels	Yes	-	Channel names. Example: System, Security
levels	No	-	Levels to keep; empty means all. One of Critical, Error, Warning, Information, Verbose
include_event_ids	No	-	Event IDs to keep; empty means all
exclude_event_ids	No	-	Event IDs to drop; wins over the include list
sources	No	-	Provider name patterns. Example: Citrix*
bookmark_path	No	-	File persisting the subscription position; use a distinct one per instance
backlog	No	false	Replay events from the bookmark, or the whole channel without one, before tailing live
redact_pii	No	false	Blank account names and addresses in Security events
poll_interval	No	30s	Bookmark flush cadence; delivery itself is push-based

Level names are matched without regard to case, and info is accepted for Information. Provider patterns are shell globs matched without regard to case; a pattern without a wildcard is an exact match. Without bookmark_path, each start tails from now.

Output

Each event becomes one OTel log record: channel, provider, EventID, level (mapped to OTel severity), task, keywords, the rendered message as the body, and the EventData fields as attributes.

The machine name from the event XML is emitted as winlog.computer, the uppercase spelling Windows uses. The host a record belongs to is the FQDN on the resource — the same value the metrics carry — so the record never carries its own host.name.

Operational notes

• Push, not poll. Events are delivered by subscription the moment they are written; poll_interval only drives bookmark persistence.
• Filter at the source. Level filters compile to an XPath query evaluated by the Event Log engine. EventID lists and provider globs are applied in-process. On a noisy Security channel, combining levels with exclude_event_ids keeps volume sane.
• Security channel. Reading it requires the agent to run with sufficient privilege (the service installs as LocalSystem by default, which suffices). Consider redact_pii: true when the records leave a controlled perimeter.
• Bookmarks are cheap insurance. Without bookmark_path, an agent restart loses whatever fired while it was down. With it, the subscription resumes exactly where it stopped.

Metric reference

Every metric this probe can emit. Metric is the OpenTelemetry name the OTLP, Prometheus and Zabbix outputs derive theirs from. Name is what a Nagios check and the API metrics= filter match. PRTG channel is the label PRTG shows, placeholders filled from the series' tags.

Metric	Name	PRTG channel	Unit	Description
senhub.windows_eventlog.records_emitted	senhub.windows_eventlog.records_emitted	Windows Event Log Records Emitted	#	Cumulative count of event records this probe has published to the log rail