Event log checking

bilsland · Post by **bilsland** » Mon Aug 26, 2002 12:23 pm

Hi , I have tried to use the event to check an event which I want to keep an eye on. The trouble is that once an event comes up it goes bad and stays bad with loads of alerts.

Can't you do something like only check within the last (whatever you time check)to get a status?

KS-Soft · Post by **KS-Soft** » Tue Aug 27, 2002 6:54 am

Sorry, I am not quite sure I understand the problem.

The trouble is that once an event comes up it goes bad and stays bad with loads of alerts.

HostMonitor changes status of the test to "Bad" only when it has found NEW record in the Event Log. If, after the next test, the monitor does not find a NEW "Bad" event it changes the task status to "Ok".
If you want to check Event Log but do not start any alerts, just select empty alert profile in the Test Properties dialog (e.g. "Do nothing" profile).

Regards
Alex

bilsland · Post by **bilsland** » Wed Aug 28, 2002 1:22 am

Ok , Here goes an example
I have setup an NT event log
--------------------------------------------
<b>Log source:</b>
Computer: UIC \computername
Log: Application
Event Source: blank (don't know it)
<b>Alert condition:</b>
Event type is: Succsses Audit event
Event ID equal to:1016
Descrpition contains: blank
------------------------------------------
This event alerts me when someone accesses an exchange account without being the main log on. I have set the alert to check every 15 seconds of the purpose of the test.

I access an account and the alert goes bad but the alert stays bad , this is the problem as I want to get alerted to all the accounts that get accessed so that I can log them and check later and also get an email alert each time so I can investogate straight away.

As I write this the recurrencess is on 31 and the status is still bad.

I am using 3.22

Thanks

bilsland · Post by **bilsland** » Wed Aug 28, 2002 2:46 am

To add to the last posting.

The audit check is now at 341 recurrences and it is still showing bad. I have set the profile up to report to a log file and it only shows the one that made it go bad not the seven I have done since then as a test, i.e when it stays bad for the first event it doesn't report all the others
I hope this makes sense

bilsland · Post by **bilsland** » Wed Aug 28, 2002 3:19 am

To add to the last to emails

The status has changed to good after 278 recurrences and it hasn't logged any of the events when it was bad. I has cause it to go bad again and it has done the same

Make sense?

KS-Soft · Post by **KS-Soft** » Wed Aug 28, 2002 12:54 pm

I see. I know only one reason to this behavior: you check Event Log on remote system and local and remote computers have different system time. Am I right? If yes, just synchronize timers on both systems.

Regards
Alex

bilsland · Post by **bilsland** » Thu Aug 29, 2002 3:26 am

Yes you are correct. I will set the servers to the same time and test that way and report back to you