Every Windows server, firewall and switch in your office is writing a diary of logons, failures and changes. EventLog Analyzer collects those diaries in one place so you can actually read them. Here is the install, done in the right order, with the checks that prove it works.
When something goes wrong in a network, the first question is always the same: who logged in, from where, and what changed? The answers already exist, scattered across Event Viewer on every machine. EventLog Analyzer pulls Windows event logs and syslog from your whole network into one searchable console. This guide covers the full first run: plan the server, install it as a service, add the right sources first, and prove the logs are flowing before you call it done. The complete live walkthrough is in the video above.
EventLog Analyzer is a log management and SIEM-style tool from ManageEngine. It collects Windows event logs agentlessly or through agents, receives syslog from firewalls, routers, switches and Linux machines on ports 513 and 514, and turns all of it into searchable records, reports and real-time alerts. It ships with predefined reports, including compliance templates for standards such as PCI DSS, HIPAA, SOX and GDPR.
Be clear about what it is not. It does not manage PCs, deploy software or patch anything; sibling tools do that. Its one job is evidence: a central, searchable history of who did what on your network. If you install it with two or three real questions in mind, like failed logon attempts and account lockouts, the setup decisions below become easy.
The installer itself is light, but a log server is a growing database, not a finished program. Put EventLog Analyzer on a Windows Server (or a solid Windows machine) that stays on all day, with storage on a fast drive and room to grow. Logs arrive every second from every source you add, and the indexed data plus archives will keep eating disk for as long as you keep retention turned on.
Three checks before you run setup: the machine's clock is synced (covered in the time-sync guide in this series), ports 8400, 513, 514 and 33335 are free, and you have a domain service account ready for Windows log collection. Using a dedicated service account instead of your personal admin login is a small step that prevents a very bad day when a password changes.
ManageEngine_EventLogAnalyzer_64bit.exe as administrator on the chosen server.8400.The service choice matters more than it looks. As a plain application, collection stops the moment someone logs off or the server reboots for updates, and your log history gets silent gaps exactly when incidents tend to happen. As a service it starts with the OS and collects around the clock, which is the entire point of a log server.
Open a browser and go to http://server-name:8400 and sign in with the default administrator account, then change its password before anything else. Adding Windows machines is done from Settings, then Log Source Configuration, then Devices. Add your domain first under Domains and Workgroups using the service account, let the device list populate, then select the machines to monitor.
In agentless mode, the collector on the EventLog Analyzer server reaches out to each Windows machine over WMI and RPC, which uses ports 135, 445 and 139 plus dynamic RPC ports. If a device refuses to connect, it is almost always one of three things: the firewall on that machine, the credentials, or the Windows services WMI depends on. Fix those before you suspect the product.
Network devices cannot run an agent, so they speak syslog instead. On your firewall or Linux server, set the syslog destination to the EventLog Analyzer server's IP on port 514. On a Linux host running rsyslog, one line in the config does it:
*.* @192.0.2.10:514
Replace the address with your server's real IP, restart the rsyslog service, and generate one test event, like a failed SSH login. Within moments the device appears in the console and the event becomes searchable. The moment a firewall's logs land in the same console as your domain controllers' logs, the tool starts paying for itself: one search can follow a user from the VPN door to the file server.
Do not finish on the install screen; finish on evidence. Pick three checks: a failed logon you just caused on a workstation should appear in search within a minute or two; the dashboard should show today's event counts climbing; and every added source should show a fresh last-received time. If any source is silent, its clock, credentials or firewall rules are the suspects, in that order.
One honest warning to close: EventLog Analyzer collects whatever the sources are configured to log. If Windows auditing is switched off on a server, no tool can recover events that were never written. Turning on the right audit policies is part of the setup, and the reports guide in this series shows which ones matter.
The complete EventLog Analyzer installation, with the console screens and device adding shown live, is in the full video.
▶️ Watch Full VideoThere is a 30-day trial that is fully functional, and a Free edition that continues with up to five log sources. Beyond that, licensing is counted by the number of log sources you monitor, not by how much log data they produce. Check the current licensing page in the product before budgeting, because editions and terms change.
By default the web console uses port 8400, the syslog listeners use 513 and 514, and the bundled database uses 33335. For agentless Windows collection, the target machines need WMI and RPC reachable, which means ports 135, 445 and 139 plus dynamic RPC ports. Firewalls between the server and a source are the most common reason a device stays silent.
As a service, always. A service starts with Windows and keeps collecting when nobody is logged in, including after patch reboots at 3 AM. Installed as an application, collection silently stops when the session ends, and the missing hours are usually the ones you later need.