Monitoring events

The WiTS event monitor window displays various system events such as process starts and exit, new network connections, logon session changes and more. A sample monitor display output is shown below.

Events are displayed in the event monitor window with a timestamp indicating when they were logged. As events are added to the end of the scrolling display, they are briefly highlighted to indicate that new events have arrived.

The toolbar in the event monitor window provides the following functions:

• The Save button saves the currently displayed events to a file. Note this only saves the currently displayed events. Continuous logging of events to a file is separate and independent functionality.
• The Clear button discards all event messages and clears the event monitor window.
• The Stop stops the event monitor while keeping the window open. When stopped, the button changes into a Start that resumes logging of events.
• The Options button brings up the preferences page that allows configuration of event monitor settings such as number of events to display.
• The Filters button brings up the preferences page that allows selection of which events are displayed in the event monitor.
• The Keep on top checkbox, if enabled, keeps the event monitor on top of other windows at all times so that it is always visible.
• The Enable autoscroll checkbox controls automatic scrolling of the event monitor window as new events are added. Normally, the display scrolls up as new event messages are added. This behaviour can be distracting when you have scrolled up to look at previous events and new events arrive. This checkbox allows this behaviour to be turned off.

In all cases, the event monitor is always shown at the same location and size as its last invocation.

Wherever relevant, data logged in each event is linked to the corresponding object. For example, an event for a process starting up is linked to the properties page view for that process.