Install ManageEngine EventLog Analyzer

Prepare the Server First

EventLog Analyzer is a log management and SIEM-style tool from ManageEngine. It collects Windows event logs agentlessly or through agents, receives syslog from firewalls, routers, switches and Linux machines, and turns all of it into searchable records, reports and real-time alerts. Be clear about what it is not: it does not manage PCs, deploy software or patch anything. Its one job is evidence — a central, searchable history of who did what on your network.

Give it an honest home: a Windows Server (or a solid Windows machine) that stays on all day, with storage on a fast drive and room to grow. A log server is a growing database, not a finished program — the indexed data plus archives will keep eating disk for as long as retention is turned on. Three checks before you run setup: the machine's clock is synced (log timestamps without NTP sync are fiction), the ports below are free, and you have a dedicated domain service account ready for Windows log collection — not your personal admin login, so a password change one day does not silently stop collection.

The ports this server needs free: 8400 for the web console you open in a browser, 513 and 514 for the syslog listener (firewalls, Linux and network devices), and 33335 for the bundled PostgreSQL/MySQL database. That database port is internal and bound to localhost, so it does not need to be opened in the firewall.

Download and Run the Installer

Download EventLog Analyzer from ManageEngine's official website only, and run ManageEngine_EventLogAnalyzer_64bit.exe as administrator on the chosen server. Accept the defaults unless you must change the web console port 8400 — that choice is offered during installation.

Install It as a Windows Service

When the setup asks how the product should run, choose to install it as a Windows service. Finish the wizard and let the service start.

This choice matters more than it looks. As a plain application, collection stops the moment someone logs off or the server reboots for updates — and your log history gets silent gaps exactly when incidents tend to happen. As a service it starts with the OS and collects around the clock, which is the entire point of a log server.

First Login — Change the Default Password

Open a browser and go to the console on the server's name and port 8400, then sign in with the default administrator account:

http://server-name:8400

Replace server-name with your own server's name or IP address. Change the default administrator password before you do anything else — the console holds your network's security history, and the default password is public knowledge.

Add Your Domain Controllers First

Almost every investigation in a Windows network is really an identity question — which account, from which machine, at what time — and domain controllers hold those answers: logon successes and failures, account lockouts, group changes and policy changes all land on the DCs first. Adding Windows machines is done from Settings → Log Source Configuration → Devices. Add your domain first under Domains and Workgroups using the service account, let the device list populate, then select the domain controllers to monitor.

In agentless mode, the collector on the EventLog Analyzer server reaches out to each Windows machine over WMI and RPC, which uses ports 135, 445 and 139 plus dynamic RPC ports on the target machines. If a device refuses to connect, it is almost always one of three things: the firewall on that machine, the credentials, or the Windows services WMI depends on. Fix those before you suspect the product.

Point the Firewall and Linux at It by Syslog

Network devices cannot run an agent, so they speak syslog instead. On your firewall, set the syslog destination to the EventLog Analyzer server's IP address on port 514. Your firewall is the only witness to everything entering and leaving the network — VPN logons from home, blocked connection attempts, traffic to suspicious destinations — and it starts reporting within minutes, with no agent and no credentials to manage.

On a Linux host running rsyslog, one line in the configuration does the same job:

*.* @192.0.2.10:514

Replace the address with your EventLog Analyzer server's real IP, restart the rsyslog service, and generate one test event — a failed SSH login is perfect. Within moments the device appears in the console and the event becomes searchable. The moment a firewall's logs land in the same console as your domain controllers' logs, the tool starts paying for itself: one search can follow a user from the VPN door to the file server.

Verify the Logs Are Really Flowing

Do not finish on the install screen; finish on evidence. Pick three checks: a failed logon you just caused on a workstation should appear in search within a minute or two; the dashboard should show today's event counts climbing; and every added source should show a fresh last log received time — not just a green tick from the moment you added it. If any source is silent, its clock, credentials or firewall rules are the suspects, in that order.

Then grow in the right order: file and application servers next, because that is where the data lives; other servers and network devices after that; workstations last — they are genuinely useful for spotting a compromised PC, but they are the noisiest sources you own, and adding 150 PCs on day one mostly buys disk usage and alert noise. One layer at a time, a few days apart, is how a log project survives.