---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Enable log monitoring in a Windows environment

# Enable log monitoring in a Windows environment {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

To enable monitoring logs in a Windows environment, select the relevant policy and
assign specific check parameters to the policy. When log monitoring is enabled and a
specified string is discovered in the log being monitored, the system creates an
event.

## Before you begin

Role required: agent_client_collector_admin

## Procedure

1. Navigate to AllAgent Client CollectorPolicies.
2. Select the Windows log monitoring policy.
3. On the Check Instances tab, select os.windows.check-log to enable monitoring Windows log files.
4. On the Check Parameters tab, specify the log parameters to be monitored by the check, as described in the following table:  
   {#acc-enable-log-monitoring-windows__table_qp2_vht_44b__entry__2}

   | Name | Value |
   |-|-|
   | warning | Number of times the specified pattern strings are found in the log which generates a warning event. Default = 1. For example, if the pattern value is Exception and one Exception event is located in the log, a warning event is generated. |
   | critical | Number of times the specified pattern strings are found in the log which generates a critical event. Default = 2. For example, if the pattern value is Exception and two Exception events are located in the log, a critical event is generated. |
   | file | Location of the log file. |
   | pattern | Strings which are being searched for in the log. Default values are Severe and Exception. Other possible values include 404 and Error. Ensure that you separate multiple patterns with a pipe (\|) and pass it as a parameter inside quotes. For example: `"SEVERE|404"`. |
   [Table 1. Check parameters]

   {#acc-enable-log-monitoring-windows__table_qp2_vht_44b}

*[\>]: and then