DataDog/dd-agent — pull request #224 by conorbranagan (2012-10-10 22:04:21+00:00)
Title: Windows Event Log Check

This will search the event log on different filters, all described in the example configuration.

This was originally requested by a customer, but I think it's definitely worth getting this in to close out the Windows integration. I can see this definitely being super useful.

I still have to test Windows 2003 because there's supposed to be a discrepancy in how they name the EventType value. The old version uses numbers instead of strings, so like "1" corresponds to "Error". In the newer versions, they just use "Error".

Finally, the one annoyance is that the WQL query seems to ignore the timestamp and just looks at the date your searching. That means we'll get every event (within the filters) for the last day, so right now we're doing additional filtering in memory. I searched around for fixes on this but no one really seems to say anything about it. It's not a huge deal, but it could slow the check if there are a lot of matching events.