RE: [SA-list] Event Log Monitoring

[Richard Temple]

Title: Message

Would it be worth everyone contributing to a document that details typical event id's to monitor. Similar to how woodstone.nu hosts a page showing typical pager numbers available.

 

This would save each user re-inventing the wheel.

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Bradshaw
Sent: 25 November 2003 14:48
To: [EMAIL PROTECTED]
Subject: RE: [SA-list] Event Log Monitoring

Yeah.  The number of events is a minimum, not a maximum.

Mark Bradshaw
Salem Web Network
[EMAIL PROTECTED]
9401 Courthouse Road, Suite 300
Chesterfield, VA 23832
804.768.9404 x123

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Tobie Fysh
Sent: Tuesday, November 25, 2003 9:30 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [SA-list] Event Log Monitoring

Ahhh - works fine. If there are two events in the last ten minutes will it still alert then??

-----Original Message-----
From: Mark Bradshaw [mailto:[EMAIL PROTECTED]
Sent: 25 November 2003 13:43
To: [EMAIL PROTECTED]
Subject: RE: [SA-list] Event Log Monitoring

A couple things.  The -p option isn't needed for SA.  It's only useful if you're running the script manually to see what events are caught by the criteria you specify.  Second, you've told checkevt that you don't care how many events it matches by putting an asterisk in the "number" column.  In fact, the code doesn't really handle an asterisk there.  It NEEDS a number.  Probably what you want is this:

 

    moon:system:10:1:4:*:id:26

 

That says you need at least one matching event to alert.  Try that and see what it does for you.

Mark Bradshaw
Salem Web Network
[EMAIL PROTECTED]
9401 Courthouse Road, Suite 300
Chesterfield, VA 23832
804.768.9404 x123

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Tobie Fysh
Sent: Tuesday, November 25, 2003 7:10 AM
To: [EMAIL PROTECTED]
Subject: [SA-list] Event Log Monitoring

Hi Everyone,

Got a problem while trying to use the event log monitoring from http://www.networksimplicity.com/utils/#checkevt

The script that I use is:

c:\Perl\bin\perl.exe "C:\Documents and Settings\administrator\Desktop\checkevt.pl" moon:system:10:*:4:*:id:26 -p

I'm trying to catch the following error. http://www.tobiefysh.f2s.com/moon.JPG

Every time I use the command I get a errorlevel of 1 no matter if there are 30 events or no events (I've changed the time to be the last 1000000 minutes with the same problem).

Any ideas??

Regards,
Tobie Fysh
Technical Services Analyst
Borough Council of Kings Lynn & West Norfolk [BCKLWN]