Overview

By default, GFI EventsManager collects the last 2000 Windows Events generated on the target computer.

This article explains the process of customizing the number of Windows Events collected from a target machine.

Process

To customize this default value:

GFI EventsManager 8 and newer

1. Open Control Panel > Administrative Tools > Services.
2. Stop the GFI EventsManager service.
3. From Windows Explorer, browse to the <ESMInstallDir>\Data\Settings\ESM Settings folder.
4. Locate the file Advanced Settings.xml.gz and double-click on it to extract the XML file.
5. Open the XML file Advanced Settings.xml.gz using Notepad or any other text editor.
6. Change the value of LastNEvents to the value you want. If it is set to 0, EventsManager will collect all the events.
7. Click Save and close the file.
8. You then need to re-zip the file in gz format.
9. Start the GFI EventsManager service.
   
   

GFI EventsManager 7

1. Open Control Panel > Administrative Tools > Services.
2. Stop the GFI EventsManager service.
3. From Windows Explorer browse to the <ESMInstallDir>\Data folder.
4. Open the XML file toolcfg_setting.xml using Notepad or any other text editor.
5. Change the value of LastNEvents to the value you want. If it is set to 0, EventsManager will collect all the events.
6. Click Save and close the file.
7. Start the GFI EventsManager service.