How can I customize the number of Windows Events collected from a target computer on a first scan?

The information in this article applies to:

  • GFI EventsManager 7
  • GFI EventsManager 8

Article ID: KBID002857

Query keywords: Event collection

By default GFI EventsManager collects the last 2000 Windows Events generated on the target computer.  

To customize this default value proceed as follows:

GFI EventsManager 8.0

  1. Open 'Control Panel' -> 'Administrative Tools' -> 'Services'.
  2. Stop the GFI EventsManager service.
  3. From Windows Explorer browse to the <..\Program Files\GFI\EventsManager 8\Data\Settings\ESM Settings> folder.
  4. Locate the file 'Advanced Settings.xml.gz' and double click on it to extract the XML file.
  5. Open the XML file 'Advanced Settings.xml.gz' using Notepad or any other text editor.  
  6. Change the value of ‘LastNEvents’ to the value you want. If set to 0 EventsManager will collect all the events 
  7. Save and close the file.
  8. Start the GFI EventsManager service.


GFI EventsManager 7

  1. Open 'Control Panel' -> 'Administrative Tools' -> 'Services'.
  2. Stop the GFI EventsManager service.
  3. From Windows Explorer browse to the <..\Program Files\GFI\EventsManager 7\Data> folder.
  4. Open the XML file 'toolcfg_setting.xml' using Notepad or any other text editor.  
  5. Change the value of ‘LastNEvents’ to the value you want. If set to 0 EventsManager will collect all the events 
  6. Save and close the file. 
  7. Start the GFI EventsManager service.