Configure for Application Events log error

Sainyam · Post by **Sainyam** » Tue Sep 06, 2011 12:11 am

Hello,

I have configured the test for Application Events log through Active RMA, and in Alert condition I have selected the Error and failure event types. I have scheduled the test to run after every 30 Mins even I have tried this by decrease the interval to 5 mins., but the wired thing is that, if I create on test Application error log and run immediately HM test it detect that error and send me a mail, I had then created one more test error event but when it performed the test as per schedule it does not detect any error.

Please help me in that

KS-Soft Europe · Post by **KS-Soft Europe** » Tue Sep 06, 2011 7:21 am

What is "NT Event Log" test status, after test performed by schedule (Ok, Bad e.t.c.) ?
May be "NT Event Log" test have detected error event (Bad status is set), however e-mail alert was not send to you ?
Could you please check if
"Condition to start action" is set to "Repeat until status changes".
With this option selected you will receive e-mail each time test will detect "Bad" event.

Please check the manual or visit our web site for more information at:
http://www.ks-soft.net/hostmon.eng/mfra ... htm#Repeat

Also, if test detected "Bad" event, however alert action was not started, we recommend to read following article that helps to find problem reasons:
http://www.ks-soft.net/cgi-bin/phpBB/vi ... php?t=4804

Sainyam · Post by **Sainyam** » Tue Sep 06, 2011 7:59 pm

Thanks for the reply

the "NT Event Log" status changed to OK after performing scheduled the test. But when I loged-in to server and see Event viewer and could see few error events. So, it doesn't look the error in alert profile. I forgot to add one more thing to it, that I am using Active RMA for this.

One questions
Does the test reply depends on few no. of latest logs or it start checking the log where it ends in last test?

KS-Soft · Post by **KS-Soft** » Wed Sep 07, 2011 5:59 am

Could you please export test settings into text file and send to us (support@ks-soft.net)?
What version of HostMonitor and RMA do you use?
Windows? Service Pack?

Regards
Alex

Sainyam · Post by **Sainyam** » Fri Sep 09, 2011 8:15 pm

Thanks for reply

Sorry for my late reply, While generating report I found one option in the settings of alert " Report for all events". I have selected this now, I hope it will work out.

Secondly if I wanted in the events log alert that mail also contains the Source of the event and the Event ID.
Can you help in out how can I do that.

One more I like to configure to stop getting duplicate alerts.

KS-Soft wrote:Could you please export test settings into text file and send to us (support@ks-soft.net)?
What version of HostMonitor and RMA do you use?
Windows? Service Pack?

Regards
Alex

KS-Soft · Post by **KS-Soft** » Sat Sep 10, 2011 5:45 am

Secondly if I wanted in the events log alert that mail also contains the Source of the event and the Event ID.
Can you help in out how can I do that

Quote from the manual
===================
the following variables represent parameters of the last "Bad" event detected:
%NTEventSource% - Event source. Identifies the software that logged the event
%NTEventComp% - Name of the computer where the event occurred
%NTEventTime% - Time of the event
%NTEventType% - Type of the event
%NTEventID% - Event identifier
%NTEventText% - Event description
%NTEventUser% - Represents the user name if an event is attributed to a specific user

Regards
Alex

Sainyam · Post by **Sainyam** » Tue Sep 13, 2011 3:00 am

KS-Soft wrote:
Secondly if I wanted in the events log alert that mail also contains the Source of the event and the Event ID.
Can you help in out how can I do that
Quote from the manual
===================
the following variables represent parameters of the last "Bad" event detected:
%NTEventSource% - Event source. Identifies the software that logged the event
%NTEventComp% - Name of the computer where the event occurred
%NTEventTime% - Time of the event
%NTEventType% - Type of the event
%NTEventID% - Event identifier
%NTEventText% - Event description
%NTEventUser% - Represents the user name if an event is attributed to a specific user

Regards
Alex

Thanks so much for this pretty info.

One more I had asked is there any way to stop getting duplicate alerts?

KS-Soft Europe · Post by **KS-Soft Europe** » Tue Sep 13, 2011 5:12 am

One more I had asked is there any way to stop getting duplicate alerts?

What setting do you use for actions: Repeat: N times; or until status changes ?
(http://www.ks-soft.net/hostmon.eng/mfra ... htm#Repeat)

Sainyam · Post by **Sainyam** » Tue Sep 13, 2011 7:25 pm

KS-Soft Europe wrote:
One more I had asked is there any way to stop getting duplicate alerts?
What setting do you use for actions: Repeat: N times; or until status changes ?
(http://www.ks-soft.net/hostmon.eng/mfra ... htm#Repeat)

Thanks for replying

I am using repeat until status changes. If I does not use this setting then I think it won't alert me for alert me for other bad events if its status of last test was bad. So to get alert for all bad events I selected this setting. Kindly suggest me if there any other option by which I can configure the option to get alert for every unique bad event of that test.

For e.g my one application trying to get connect to SQL server and its login failed continuously around 700 times a day by the same user and I got the alert for the same by HM around 400 emails (100 in per test). So I just wanted to configured any option by which it does not send duplicate alert on same test.

KS-Soft · Post by **KS-Soft** » Wed Sep 14, 2011 4:55 am

You may use "advanced mode" action to skip action when several events with the same description appears in the log one after another.
E.g. you may use expression like
('%SimpleStatus%=='DOWN') and ('%Reply%'<>'%LastReply%)

Please check the manual or visit our web site for more information
http://www.ks-soft.net/hostmon.eng/mfra ... ncedaction

The problem: if there are several different events appear again and again (like event1, event2, event3, event2, event1, event3), there is no way to reports event1 just once.

Regards
Alex

Sainyam · Post by **Sainyam** » Wed Sep 14, 2011 11:39 pm

KS-Soft wrote:You may use "advanced mode" action to skip action when several events with the same description appears in the log one after another.
E.g. you may use expression like
('%SimpleStatus%=='DOWN') and ('%Reply%'<>'%LastReply%)

Please check the manual or visit our web site for more information
http://www.ks-soft.net/hostmon.eng/mfra ... ncedaction

The problem: if there are several different events appear again and again (like event1, event2, event3, event2, event1, event3), there is no way to reports event1 just once.

Regards
Alex

Thanks for Reply,

I have tried to apply this setting in advance mode ('%Reply%'<>'%LastReply%)

and I hope it works fine, I am on testing it. As confirmed I will update the forum.

Sainyam · Post by **Sainyam** » Wed Sep 21, 2011 8:28 pm

Thanks, it working,

Is there any way to define variable like %LastNTEventID%

I think if we use

('%SimpleStatus%=='DOWN') and ('%NTEventID%'<>'%LastNTEventID%')

it will put restriction more on duplicacy and result in faster as well.

Whats your suggestions onit.

KS-Soft · Post by **KS-Soft** » Thu Sep 22, 2011 7:56 am

Yes, I think we can implement several additional variables.

Regards
Alex

Sainyam · Post by **Sainyam** » Mon Sep 26, 2011 7:30 pm

KS-Soft wrote:Yes, I think we can implement several additional variables.

Regards
Alex

Thanks,

Tell me the steps for this. Which files I need to edit for to doing the same.

KS-Soft · Post by **KS-Soft** » Tue Sep 27, 2011 5:16 am

Do you want to modify HostMonitor by yourself??
Even if we provide source codes, you will need a year to get familiar with the code.

Regards
Alex