11.2.8 Client Pro Practice Questions

As part of the regular system maintenance on your Windows system, you are checking Performance Monitor statistics and Event Log events. You notice that there are several Error events listed with the same ID number. They also contain a description that sounds as if the error is related to system hardware. You check your Performance Monitor logs but don't notice anything unusual around the time that the events were generated. Which step must you take to get an email every time the event is logged so you can check the system statistics at that moment? Configure Event Subscriptions. Attach a task to the event. Configure an Event Trace Data Collector. Configure a performance counter alert.

Attach a task to the event. EXPLANATION Attach a task to an event or log to receive a notification or take other actions when an event is logged. Tasks attached to an event execute the action whenever an event with that ID, source, and log occurs. Use a performance counter alert to configure triggers that take an action when a counter reaches a threshold value. Alerts monitor a system performance statistic, such as processor time or disk space. They do not monitor Event Log events. Use an Event Trace Data Collector in Performance Monitor to capture events logged by software processes. Use Event Subscriptions to view a set of events stored in multiple logs on multiple computers. Events that occur on one computer are sent to another computer. They are saved there and can be viewed. REFERENCES TestOut Client Pro - 11.2 System Events

On your Windows system, you run a custom application that was developed in-house. The application generates Event Viewer events and logs those events to the default Application and the Security logs in Event Viewer. As you monitor the application, you would like to be able to do the following: - View all events related to the application from a single log. - View only the events related to the application and no others. - View the necessary events with minimal future configuration. - Save the Event Viewer configuration so that you can easily export and import the solution to other servers that will be running the application. What should you do? Create a filter on the Application and Security logs. Create a Custom View. Attach a task to the event IDs generated by the application. Configure Event Subscriptions.

Create a Custom View EXPLANATION A Custom View is a saved filter. Custom Views apply filter criteria to one or more event logs. The filter criteria for a Custom View is similar to that of a filter, but it also includes the log(s) you want to include in the view. Custom Views are saved between Event Viewer sessions and are available each time you use Event Viewer. You can export a Custom View and import it on another system. This exports and imports the Custom View criteria, but it does not export or import the events showing in the view. Adding a filter in Event Viewer has the following limitations: - You cannot save a filter. Each time you start Event Viewer, you will need to redefine the filter criteria. - Filters apply only to a single log. You cannot filter multiple logs into a single view. - You cannot export and import filter criteria to other computers. Use Event Subscriptions to view a set of events stored in multiple logs on multiple computers. Events that occur on one computer are sent to another computer, where they are saved and can be viewed. Attach a task to an event or a log to receive notification or take other actions when an event is logged. REFERENCES TestOut Client Pro - 11.2 System Events

Using Event Viewer, you have created a Custom View to track Warning and Error events from both the Application and System logs. After a few days, there are several events in the Custom View. You would like to clear the messages from the view so that you only see messages starting from today. How do you make sure that any messages from today that are in the corresponding logs still exist? Save the events in the Custom View. Edit the Custom View properties and create a custom range for the logged events, starting with today's date. Clear the Custom View. Export the Custom View and then import it with a new name. Clear the Application and System logs.

Edit the Custom View properties and create a custom range for the logged events, starting with today's date. EXPLANATION A Custom View shows all messages that exist in the corresponding log. To remove older messages from the Custom View without deleting the messages, edit the Custom View properties to change the logged parameters. You cannot clear a Custom View. You can only edit the filter properties that determine which events are shown. Clearing the logs specified by the Custom View filter properties will clear the Custom View, but this also deletes the events from the log. REFERENCES TestOut Client Pro - 11.2 System Events

You manage two Windows systems named Computer 1 and Computer 2. You have configured Event Subscriptions with the default settings to forward events from these two computers to a third Windows system named Computer 3. How do you view the events from these two computers on Computer 3? In Event Viewer, open the Forwarded Events log. In Resource Manager, apply a filter for Computer 1 and Computer 2. In Event Viewer, create an event filter that includes all logs and has as a source Computer 1 or Computer 2. In Performance Monitor, create a Data Collector Set to gather data from Computer 1 and Computer 2.

In Event Viewer, open the Forwarded Events log. EXPLANATION By default, events received from source computers are saved in the Forwarded Events log in Event Viewer. You could create a filter, but the filter would not show any information that is different from what is in the Forwarded Events log. Use a filter if you want to add additional filters to the events in that log. Use System Monitor and Performance Monitor to track statistics about the operation of the local computer. REFERENCES TestOut Client Pro - 11.2 System Events

You have two Windows systems named Computer 1 and Computer 2. Over the next few days, you want to be able to monitor Computer 1 from Computer 2. To do this, you want to automatically save and send Computer 1's Application and System logs to Computer 2. How would you do this? On Computer 1, attach a task to the Application and System logs. Configure the task to run a script that copies the logs to Computer 2. On Computer 1, create a scheduled task that saves the Application and System logs to a network share. Configure the schedule to run every 15 minutes. On Computer 2, open the Reliability and Performance Monitor and connect to Computer 1. Create a Data Collector Set with event trace data. On both computers, enable and configure Event Subscriptions. Configure Computer 1 as a source and Computer 2 as a collector.

On both computers, enable and configure Event Subscriptions. Configure Computer 1 as a source and Computer 2 as a collector. EXPLANATION To save events from one server to another, use Event Subscriptions. When an event occurs on the source server, those events are recorded on the local system and sent to the collector server. You can use Event Subscriptions to collect and view events from multiple servers. Events are saved on the collector server, where they can be viewed and managed from Event Viewer. The default location for these events is the Forwarded Events log. Use Reliability and Performance Monitor to monitor system statistics, such as processor percentage or disk space. Attach a task to an Event log or an event to send an email, display a message, or run a program when an event occurs. REFERENCES TestOut Client Pro - 11.2 System Events

You are troubleshooting a problem that keeps occurring on your Windows system. When the problem happens, Event Viewer shows several Error events in the Application and System logs. From a single view, you would like to see only Error events from both the Application and the System logs. What can you do in Event Viewer to make this happen? On both the Application and System logs, filter the logs to show only Error events. For both logs, save the filter to a Custom View. On the Application log, filter the log to show only Error events. Save the filter to a Custom View and then add the System event log as an additional filter. On both the Application and System logs, create a filter to show only Error events. Save the changes for both logs. On both the Application and System logs, create a Custom View.

On the Application log, filter the log to show only Error events. Save the filter to a Custom View and then add the System event log as an additional filter. EXPLANATION To view events from multiple logs at the same time, create a single Custom View that includes both logs. You can create a view from an existing filtered log and then modify the filter criteria. You can also just create a single new view with the necessary settings. Creating a Custom View from both logs leaves you with two Custom Views instead of one. Saving the logs saves the messages in the log. You can also save the filtered log file to save only the messages currently showing. REFERENCES TestOut Client Pro - 11.2 System Events

You manage three Windows systems that are part of a Workgroup. You would like to configure Event Subscriptions so that you can view all events from those computers on your Windows notebook. You need to configure the three source computers and one collector computer. The subscription will be a source-initiated subscription. What should you do? (Select two. Each answer is part of the complete solution.) On all four computers, configure the subscription. On the collector computer, configure the subscription. On all four computers, run the winrm qc-q command. On the collector computer, run the wecutil qc /q command. On the source computers, run the winrm qc -q command. On the collector computer, run the wecutil qc /q command.

On the collector computer, configure the subscription. On all four computers, run the winrm qc-q command. On the collector computer, run the wecutil qc /q command. EXPLANATION To configure Event Subscriptions for a source-initiated subscription: - Run the winrm qc -q command on all computers. - In the Local Policy or Group Policy that applies to the source computers, be sure to identify the FQDN (fully qualified domain name) of the collector computer. - On the collector computer, run the wecutil qc /q command. - On the collector computer, open Event Viewer and configure the subscription properties (such as the location of the forwarded events). REFERENCES TestOut Client Pro - 11.2 System Events

You would like to configure Event Subscriptions on your Windows system to forward events to a network server. You need to configure your computer as a source computer for a source-initiated subscription. Which of the following will be part of your configuration? (Select two.) Run the winrm qc -q command. Add the collector computer to the Event Log Readers group. Run the wecutil qc /q command. Configure the Local Security Policy to identify the FQDN of the collector computer.

Run the winrm qc -q command. Configure the Local Security Policy to identify the FQDN of the collector computer. EXPLANATION Use a source-initiated subscription to configure a subscription when all the possible source computers are not known. To configure a source computer for source computer-initiated subscriptions: - Run the winrm qc -q command to run WinRM. - Configure and enable the Event Forwarding Policy through Group Policy or the Local Security Policy an dthen specify the collector computer's FQDN. Run the wecutil qc /q command on the collector computer for collector-initiated subscriptions. The other task is performed when configuring collector-initiated computers. REFERENCES TestOut Client Pro - 11.2 System Events

You would like to configure Event Subscriptions on your Windows system to forward events to a network server. You need to configure your computer as a source computer for a collector-initiated subscription. Which of the following will be part of your configuration? (Select two.) Run the wecutil qc command. Run the winrm qc command. Configure the Local Security Policy to identify the FQDN (fully qualified domain name) of the collector computer. Add the collector computer to the Event Log Readers group. Make the source computer a member of the SubscribedComputers group.

Run the winrm qc command. Add the collector computer to the Event Log Readers group. EXPLANATION Use a collector-initiated subscription to explicitly identify source computers that can forward events to the collector computer. To configure a source computer for collector-initiated subscriptions: - Run the winrm qc command to run WinRM. - Add the collector computer account to the local Event Log Readers group or the local Administrators group. Run the wecutil qc command on the collector computer for collector-initiated subscriptions. The other tasks are performed when configuring source computer-initiated subscriptions. You would edit the Local Security Policy or Group Policy to identify the collector computer when configuring a source computer for source computer-initiated subscriptions. Adding the source computer to a computer group is a task performed in Active Directory or on the collector computer. REFERENCES TestOut Client Pro - 11.2 System Events

You are troubleshooting a problem that keeps occurring on your Windows system. When the problem happens, there are several Warning and Error events logged to the Application log in Event Viewer. You create a Custom View that shows only Warning and Error events. During troubleshooting, you filter the Custom View to show only the Error messages. How can you create a new Custom View using the current filter settings? Save the filter to a Custom View. Copy the Custom View using a new name. Export the Custom View and then import it using a different name. Save the events in the Custom View.

Save the filter to a Custom View. EXPLANATION To create a new Custom View based on a filter that has been applied to it, right-click the Custom View and click Save Filter to Custom View. Exporting or copying the Custom View can be used to create a Custom View based on the properties of the existing one. However, filters applied to the view are not applied to its settings. Saving the events in the Custom View saves the log entries to a log file. However, it does not create a new Custom View. REFERENCES TestOut Client Pro - 11.2 System Events