Show TOC

 Central Monitoring of the Microsoft Windows Event LogLocate this document in the navigation structure


On Microsoft Windows platforms, you can monitor the Microsoft Windows event log. By default, the event log logs events from the following areas:

  • Security

    This log contains security-related events, such as file accesses and changes, or successful and failed logons. You specify which events are to be logged in the corresponding security settings.

  • Applications

    This log contains events that were written by an application or a program. The application developer decides in each case which events are to be logged.

  • System

    This log contains events that are reported by Microsoft Windows system components.

The events are divided into the following event types:

  • Information
  • Warning
  • Error
  • Success Audit and Failure Audit, only for security events

By default, after you activate event log monitoring, all event log events are monitored and displayed in the Operating System monitor in the central monitoring system (CEN).

You can also decide the following yourself with event log templates (see Structure of the Event Log Templates):

  • Which event logs are to be monitored?
  • Which event sources are to be monitored?
  • Which color should alerts of the different event types have?
  • A host agent of the SAP NetWeaver management agents must be running on the host. This is always the case on hosts with SAP NetWeaver components of Release 7.1.

    Event log monitoring is also integrated into CCMS agents, as of Patch Collection 2005/3.

  • The relevant host must be registered with CEN (see Registering SAP NetWeaver Components and Hosts in CEN).
Process Flow

To activate the monitoring of the event log, set the following parameters in the configuration file SAPCCMSR.INI:

Parameter Meaning

EventLogMon [On|Off]

EventLogMon On activates the event log monitoring on the Microsoft Windows host; by default, it is deactivated.

EventLogMon <Filepath>

This parameter specifies an event log template that contains additional configuration settings for the event log monitoring (see Structure of the Event Log Templates); by default, all event sources and all of their event types are monitored.


SAPCCMSR.INI can contain multiple entries of this type, which point to multiple event log templates.

EventLogResolveMessages [On|Off]

EventLogResolveMessages On activates the complete resolution of the event log messages, that is, a more exact description of the event is obtained using additional Microsoft Windows system calls and transferred to CEN. This means that you obtain more exact information at the cost of performance. By default, this is deactivated.

To activate these settings, you need to restart the SAP NetWeaver management agent after setting the parameters in SAPCCMSR.INI.


The Microsoft Windows event log is monitored and displayed as a subtree in the Operating System monitor of the monitored host (see Displaying the Event Log Monitoring in the Alert Monitor).

Infrastructure of the SAP NetWeaver Management Agents Start Page