Missing NT_EVENT_LOG option?

[stefan1983]

Hello dear KS-Mon support,
I am looking for a special option to monitor NT_Event_log's from a Windows 2003 Server.
Right now, the monitor-jobs are working fine and I am getting all the warnings and errors what I need to track the Server state. So far so good, but my problem is, that some special error ID's are coming up very often. Let say every 5 Minutes. So is there any rule/option to ignore error-ID's, let’s say 10 times after they occurred the first time?
Is there any option like this in KS-Mon?
Thanks in advance,
Stefan

[KS-Soft]

If such events usually appear within 5 min and test interval is 5 min or more, you may use "advanced mode" action assigned to the test and expression like ('%SimpleStatus%'=='DOWN') and (%Recurrences% mod 10==1)
http://www.ks-soft.net/hostmon.eng/mfra ... ncedaction

This way action will be started when test status changes from Good to Bad; also action will be triggered after 11, 21, 31 consecutive "bad" result.

Regards
Alex

[stefan1983]

Hello, this is very close to what I wanted! Thanks for fast reply. I will test it and use it for some Monitor jobs.....but....let’s say one Error entry in the application Event_log comes up ones and gets monitored. A second time after two weeks, the same Error comes again, but this time, the Hostmonitor will not bring the "bad" result, even two weeks ago. Right?

So is there any option to, let’s say, "reset" the (%Recurrences% mod 10==1)-counter after 24h or a week or somethins like that.....or is the only way to restart the HostMon service on the host computer to reset the counter? Is there any way to control the counter-pipe?
Greetings and sorry for my unconventional questions

[KS-Soft]

A second time after two weeks, the same Error comes again, but this time, the Hostmonitor will not bring the "bad" result, even two weeks ago. Right?

No. HostMonitor will set "Ok" status when it does not find specified "bad" event (actually it depends on test settings). So, if test interval is set to 5 min and there is no new "bad" event within 5 min, HostMonitor will set Ok status. When it finds new "bad" event, it will set "Bad" status and trigger alert.
If several "bad" events were added into log within 5 min, HostMonitor will set "bad" status just once. It may increase recurrences counter several times or just one (depends on test settings) and start alert just once or several times.

Please check the manual or our on-line help: http://www.ks-soft.net/hostmon.eng/mfra ... m#chkNTLog
================================
When HostMonitor finds new* message that fits "Bad" filter conditions, it changes status of the test item to "Bad".
Note1: here "new" means event was recorded after last test probe.
Note2: HostMonitor does not check event log records that were added while HostMonitor was not started or NT Event Log test item was not created yet.

When test status should be changed back to "Ok"? This behavior depends on the following options:

set "Ok" status when no new "Bad" events detected
HostMonitor will assign "Ok" status to the test item, when subsequent test probe does not detect new* "Bad" event (event log does not contain new events at all or none of new events meet conditions of the "Bad" filter).

set "Ok" status when new "Good" event detected
Status of the test item will be changed to "Ok" when HostMonitor finds new event that fits "Good" filter conditions.

set "Ok" status by acknowledgement (manually)
With this option chosen, test item will remain "Bad" until operator acknowledge status (then status will be changed to Ok)

...

Report about last "Bad"/"Good" event
With this option enabled HostMonitor will scan (starting from the end of the log) all new* events till first** "Bad" event. If new "Bad" event is detected, HostMonitor marks test as "Bad" and may perform specified alert actions (if necessary). This option is useful when you check for some specific event and you don't need many messages about the same recurring error.
**Note: here "first" means the most recent (last) "Bad" event as monitor scans the log from the end.

Report about all events
In opposite to previous mode, with this option enabled HostMonitor will inform you about each event that satisfies specified requirements (filters). This option is useful when you use one test item to check for different error events (e.g. you are checking for any event with "Failure Audit" type).
Note: you may need to use "Repeat: until status changes" option for associated alert actions.
...
================================

So is there any option to, let’s say, "reset" the (%Recurrences% mod 10==1)-counter after 24h or a week or somethins like that

HostMonitor resets Recurrences counter everytime test status changes from "bad" to "ok" or vice versa.

Regards
Alex