watching eventlog for timebased regularity

admax · Post by **admax** » Thu May 28, 2009 3:45 am

Hello,

I need to watch our daily backup.
I set the Backupsoftware to write eventlogentries for *every* event.

%Status%: Ok
Backup starts: event ID 2
%Status%: changes to Bad
backing up...
successfully completed: event ID 6
%Status%: Ok

so far so good. While backing up I would prefer "warning" status, but thats another question.

But last night the task hang up .. the backup didn't start at all.. and my test still shows "Ok" in the mornung because there were no new bad events since the Last ID 6.

How can I modify the test so that it turns to bad or warning status, if no events (anyone of 2,3,6,5..,10..) occurs for 24 hours or more since the last one?

Regards,
Rainer

Method = NTLog
;--- Common properties ---
;DestFolder = Root\tecando\filex\
RMAgent = tecando.FILEX
Title = tecando.FILEX, Acronis Eventlog
Disabled = Yes
Comment = NTLog localhost:Application\Acronis True Image Echo Server
RelatedURL =
CmntPattern = NTLog %host%:%path%
PLogPattern = %Agent%_Acronis_Eventlog.txt
ScheduleMode= Regular
Schedule =
Interval = 3600
Alerts =
ReverseAlert= Yes
UnknownIsBad= Yes
WarningIsBad= Yes
UseCommonLog= No
PrivateLog = C:\Programme\HostMonitor7\Logs\tecando.FILEX_Acronis_Eventlog.txt
PrivLogMode = Reply
CommLogMode = Default
;--- Test specific properties ---
Computer =
Log = Application
Source = Acronis True Image Echo Server
ReportMode = AllEvents
TestOkMode = IfGoodEvent
BadFilter = 1
CheckComp = Any
CheckType = AnyFromList
CheckID = AnyFromList
CheckDescr = Any
CompList =
TypeList = Error
TypeList = Warning
TypeList = Information
IDList = ^M4^M2^M11^M502^M5^M1009^M
DescrList =
GoodFilter = 1
CheckComp = Any
CheckType = Any
CheckID = AnyFromList
CheckDescr = Any
CompList =
TypeList = Information
IDList = ^M6^M
DescrList =

;-----------------------------------------------------------------------------
; Exported 1 items

KS-Soft · Post by **KS-Soft** » Thu May 28, 2009 9:36 am

I think you may check for EventID 6 and use "Reverse alert" option to show "Ok" status when such event detected. In any other case test status will be Bad (except Unknown status that may be displayed when HostMonitor cannot receive information from NT Event Log).

Method = NTLog
;--- Common properties ---
;DestFolder = Root\
RMAgent = tecando.FILEX
Title = tecando.FILEX, Acronis Eventlog
Comment = NTLog localhost:Application\Acronis True Image Echo Server
RelatedURL =
CmntPattern = NTLog %host%:%path%
PLogPattern = %Agent%_Acronis_Eventlog.txt
ScheduleMode= Regular
Schedule =
Interval = 3600
Alerts =
ReverseAlert= Yes
UnknownIsBad= Yes
WarningIsBad= Yes
UseCommonLog= No
PrivateLog = C:\-tests\hm 802\Logs\HostMonitor_Acronis_Eventlog.txt
PrivLogMode = Reply
CommLogMode = Default
;--- Test specific properties ---
Computer =
Log = Application
Source = Acronis True Image Echo Server
ReportMode = AllEvents
TestOkMode = IfNoBadEvent
BadFilter = 1
CheckComp = Any
CheckType = AnyFromList
CheckID = AnyFromList
CheckDescr = Any
CompList =
TypeList = Error
TypeList = Warning
TypeList = Information
IDList = ^M6^M
DescrList =

admax · Post by **admax** » Thu May 28, 2009 12:44 pm

But I still don't know if the backup startet last night... because the status is "Ok" - regardless if backup started or not.

KS-Soft · Post by **KS-Soft** » Thu May 28, 2009 1:28 pm

Event ID 6 means backup was finished, right? Then what is the problem? if backup was finished then it was started for sure.
If there is no Event with ID 6, test status will be Bad, not Ok.

Regards
Alex

admax · Post by **admax** » Thu May 28, 2009 11:36 pm

KS-Soft wrote:Event ID 6 means backup was finished, right?

Yepp.. right

KS-Soft wrote:Then what is the problem? if backup was finished then it was started for sure. If there is no Event with ID 6, test status will be Bad, not Ok.

Yes & No: If I enable the Test the first time, it's status is "bad". After the first backup completed successfully, the test finds the ID 6 and turns to "Ok". And now theres my problem: Until no new bad event comes up, the test keeps "Ok" forever.. even if the backup never starts again.

But good news: I found a solution: A secound test watches the first test.

The first test "last_backup_succeeded" looks for any Acronis-IDs Except ID 6. The test turns to "Bad" if backup starts.
"set Ok Status when new good event detected" watches for ID6 and turns to Ok if succeeded.

The secound test "status_unchanged_since_24h" adds the time-dependent component:

Warning if: %::%Agent%_last_backup_succeeded::CurrentStatusDuration_sec%>86400

not smart, but it works.

Regards
Rainer

KS-Soft · Post by **KS-Soft** » Fri May 29, 2009 11:49 am

Yes & No: If I enable the Test the first time, it's status is "bad".

You may change this by adding NoReverseAlertFor1stCheck=1 line into [Misc] section of hostmon.ini file (you need to restart HostMonitor as well).

After the first backup completed successfully, the test finds the ID 6 and turns to "Ok". And now theres my problem: Until no new bad event comes up, the test keeps "Ok" forever.. even if the backup never starts again.

I assume you have changed "set Ok status when no new Bad events detected" option to "set Ok status by acknowledgement". Just change it beck to "set Ok status when no new Bad events detected" and everything should work fine.

Regards
Alex