Windows writes down almost everything that goes wrong: failed logons, services that crash, disks that fill up, drivers that refuse to load. The trouble is that nobody reads the Event Viewer until something is already broken. EventSentry Light is the free edition of EventSentry, a monitoring suite from Netikus.net. It watches event logs and basic system health on a handful of Windows machines and tells you by e-mail, syslog or other channels when something needs attention.
It is a good fit for small networks and home labs: a few servers, a domain controller, a file server. The limits of the free edition, compared with the full product, are listed below so there are no surprises later.
EventSentry Light at a glance
| Vendor | Netikus.net (EventSentry) |
|---|---|
| Price | Free edition of the EventSentry suite |
| Licence | Free edition of EventSentry (limits below) |
| Platform | Windows workstations and servers |
| Remote installations | Up to 5 monitored machines managed centrally |
| Architecture | Management console plus a lightweight agent (Windows service) on each monitored machine |
| Support | Community and knowledge base; no e-mail or phone support in the Light edition |
What it monitors
Event logs
- All standard logs plus Directory Service, DNS Server, File Replication and any custom event log.
- Filters by log, severity, event ID, source, category and text, and by weekday or time of day.
- Recurring-event detection and summary notifications, so one noisy error does not produce 500 e-mails.
- Boot scan: events that occur while the machine is starting are processed too.
System health
- Services and drivers (alert when a service stops or changes start type)
- Disk space and directory size
- Performance counters (CPU, memory and others) and process memory
- Installed software changes and file changes
- Heartbeat: alert when a monitored machine stops responding
- Application scheduler, event log backup and clearing, full event log detection
Log files
Plain (non-delimited) text log files can be watched for keywords. Delimited formats such as CSV are reserved for the full edition.
How it can alert you
E-mail (SMTP), syslog, SNMP traps, HTTP posts, text files (plain, HTML, CSV), desktop and sound notifications, Jabber, running a process, restarting a service or even shutting a machine down. Database (ODBC) notifications are only in the full edition.
Light vs. full EventSentry
| Feature | Light | Full |
|---|---|---|
| Event log monitoring and filters | Yes | Yes |
| System health (services, disk, performance, software) | Yes | Yes |
| Remote installation and updates | Up to 5 machines | Unlimited |
| Remote service administration | No | Yes |
| Compliance tracking (logons, processes, printing, file access, account and policy changes) | No | Yes |
| Syslog and SNMP trap daemon | Writes to the event log only | Full, with web reports |
| NetFlow, HTTP receiver | Partially | Yes |
| Delimited log files, consolidation to database | No | Yes |
| Vendor support by e-mail and phone | No | Yes |
Download and first setup
- Click the Download button at the top of this page and unpack the archive.
- Run the setup on the PC you will manage from, usually your admin workstation or a small management server.
- In the management console, add the machines to monitor. You can pick them from Active Directory; the console installs the agent remotely (administrator rights on the targets and open SMB/RPC access are needed).
- Configure one notification action first — usually an SMTP e-mail to a shared admin mailbox — and send a test.
- Start with the ready-made event log and health packages, run them for a week, then silence what turns out to be noise.
Useful rules to start with
- Failed logons in bursts (event 4625) on domain controllers and file servers
- A service set to Automatic that is not running
- Free space below 10 % on any system or data volume
- Backup software writing an error to the Application log
- Unexpected shutdowns (event 6008) and disk warnings from the System log
Common problems and fixes
| Problem | What to check |
|---|---|
| Remote agent installation fails | Administrator rights on the target, File and Printer Sharing and remote administration allowed in the firewall, the admin$ share available. |
| Test e-mail never arrives | SMTP server, port and authentication; many relays require TLS on port 587. |
| Too many alerts | Use recurring-event and summary notifications, and filter by time of day for scheduled jobs. |
| Need more than five machines | That is the Light limit; the full EventSentry edition removes it. |
FAQ
Is EventSentry Light really free?
Yes. It is the free edition of EventSentry, with the feature limits shown in the table above.
How many computers can I monitor?
The Light edition manages up to five remote installations centrally.
Does it need a database or a dedicated server?
No. For basic event log and health monitoring the console and agents are enough.
Can it collect syslog from switches and firewalls?
Partly: the Light edition receives syslog and SNMP traps but only writes them to the Windows event log. Web reports on that data require the full edition.
Is it a SIEM?
The full EventSentry is positioned as a SIEM. The Light edition is better described as event log and health monitoring for a small network. If you need central log collection from many servers and network devices, look at Graylog.
