NT event log test, with Event ID exception, still sends erro

[james.wallis]

I have a site with a particular exclusion in the event log tests.
when that error is placed into the event log, we still get an error sent via hostmonitor, it is just that all content has been nulled.
the exclusion is system event id 8003.

I have disabled the exclusion at this time, but require to have this working.
What is the solution to this issue, as a blank error is a scary.



Subject: SiteName- Event Log - System - A event log error requires attention
Message from System.
SiteName- Event Log - System requires attention
Date : 23/09/2005 1:03:05 AM
Event Source:
Event Computer:
Event Time:
30/12/1899
Event Type:
0
Event ID:
0
Event Text:
Event User:

[KS-Soft]

Not quite sure I understand the problem.
Do you see empty records in NT Event Log? Or NT Event Log contains normal records but HostMonitor sends e-mail with empty fields?
- What version of HostMonitor do you use?
- Windows version?
- Service Pack?
- What e-mail template do you use for "send e-mail" action?

Regards
Alex

[james.wallis]

The real event log has the details correctly, just the email from host monitor is empty

HM Ver: 5.38
RMA Ver: RMA 3.14
WinVer: Windows Server 2003
SP : SP1
Email Template : Evet Log - just sends errors to us.

[KS-Soft]

Could you show your e-mail template? Name of the profile doesn't help in any way

Regards
Alex

[james.wallis]

The test configuration is as follows:

Test Method: NT Even Log
Log Source:
Computer UNC <local>
Log: System
Alert condition:
Computer: Any
Event Type: Error, failure audit
Event ID: Any
Description: Any
Login: nothing defined

Treat Unknown as Bad - Ticked.
Action Profile:
Event Log:
Send email 1 1
Set new test interval 1 -1

Action: Send e-mail
From: hostmonitor@site
To : support@site
Subj: %TestName% - A event log error requires attention
Mail template: Event Log
Start after: 1 consecutive "bad" result(s)
Retries: 1 time(s)

Action: Change test interval
Set new interval: 00:00:15
Start after: 1 consecutive "bad" result(s)
Retries: until status changes

[KS-Soft]

I was asking about mail template.
Could you please show your mail template? Use menu "Profiles" -> "Mail profiles" to reach mail profiles. Just show me what variables do you use in the mail.

Regards
Alex

[james.wallis]

Message from System.
%TestName% requires attention
Date : %DATETIME%

Event Source:
%NTEventSource%

Event Computer:
%NTEventComp%

Event Time:
%NTEventTime%

Event Type:
%NTEventType%

Event ID:
%NTEventID%

Event Text:
%NTEventText%

Event User:
%NTEventUser%

[KS-Soft]

Mail template looks fine
H'm... the only explanation I have - you are receiving information about empty event because HostMonitor sends this mail when no event is detected.
Its possible if
- you have assigned GOOD "send e-mail" action
- or you have used BAD "send e-mail" action but you also have marked "Reverse alert" option of the test
- or may be you have assigned this action to some other kind of the test (not NT Event Log)?
Could you please check configuration?
Or you may send configuration files to us (support@ks-soft.net). We need HML file with tests, actions.lst and hostmon.ini files.

Regards
Alex