---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Windows log monitoring default checks and policies

# Windows log monitoring default checks and policies {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Agent Client Collector provides the following policy for Windows log monitoring.
{#windows-log-monitoring-policy__table_rdf_3r1_ktb__entry__5}

| Type | Check | Description | Usage and Usage Example | Output |
|-|-|-|-|-|
| Event | os.windows.check-log | Enables monitoring log files on a Windows server. | Usage: * -c crit N: Critical level if pattern has a group. * -f -log-file FILE: Path to log file. * -o --warn-only: Warn instead of critical on match. * -q pattern PAT: Pattern to search for. To search for multiple patterns, separate each pattern with a pipe (\|) and put inside quotes. For example: "SEVERE\|404" * -w warn N: Warning level if pattern has a group. {#windows-log-monitoring-policy__ul_a5s_pr1_ktb} | Windows Log CRITICAL: Found 4 criticals, 0 warnings for pattern SEVERE\|Exception\|404\|Errorin file C:\\ProgramData\\ServiceNow\\agent-client-collector\\log\\acc.log |
[Table 1. Windows log monitoring policy]

{#windows-log-monitoring-policy__table_rdf_3r1_ktb}