Event Log

Dr.Web registers the following information in the Windows Event Log:

•Plug-in starts and stops events

•License key file parameters including validity and licensing period

•Parameters of the plug-in components including scanner, core, virus databases (information is registered when the plug-in starts or components are updated)

•License invalidity notifications if the license key file is missing, some of the plug-in components are not licensed, license is blocked or license key file is corrupted (information is registered when the plug-in checks the license)

•License expiration notifications (a message is registered in 30, 15, 7, 3, 2 and 1 days before expiration)

•Information on the malicious objects and spam detection (see the Notifications section). These notifications you can configure:

▫Filtered messages – notifications about filtered messages.

▫Filtered files – notifications about filtered attachments.

▫Infected – notifications about infected objects.

▫Spam – notifications about spam.

▫Filtered files – notifications about filtered infected objects.

▫Update – notification about update;

▫Expired bases – notifications about virus databases expiration.

▫Office control – notifications about web resources filtered byOffice Control.

Viewing Event Log

1.On the Control Panel, double-click Administrative Tools and then double-click Event Viewer.

2.In the tree view, select Administrative Tools and then select Event Viewer.

3.In the left part of the window of Even Viewer, select Doctor Web. The list of registered events will show up. The sources for Dr.Web notifications are Dr.Web® Scanning Engine, Dr.Web CMS, Dr.Web CMS Web Console, Dr.Web for MSP Scanning Service, Dr.Web for MSP Component Host and Dr.Web for MSP Requests Queue.

Redirecting Dr.Web events

To redirect Dr.Web events to the specified event log, do the following:

1.In Dr.Web CMS Web Console, select the DrWebScanSrv_1.0 -> Application Settings.

2.Specify the name of a log where Dr.Web events will be registered as a value of the EventLog variable, for example, Doctor Web.

If the EventLog variable is absent or its value is not specified, Dr.Web events will be registered in the Doctor Web log.

3.Restart Dr.Web for MSP Scanning Service.

4.Remove Dr.Web CMS for MSP from the registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Doctor Web\Dr.Web for Microsoft Server Products.

5.Restart the operating system.