Not exactly.
I need
IF 9529 is found
THEN
IF 9523 is Found
THEN SEND Email Alert (Exchange Cluster has failed over)
ELSE SEND Email Alert to Cell Phone (Mailbox Store has
failed an needs attention)
I am still worried the false start could be a problem. From what you say on
that it should only check the logs since the last check, correct?
Michael Letschin
Network Administrator
"When you have eliminated the impossible,
whatever remains, however improbable
must be the truth" -Sherlock Holmes
Registry Safe-Rent
888-881-3400
________________________________________
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dirk Bulinckx
Sent: Friday, May 06, 2005 11:06 AM
To: salive@woodstone.nu
Subject: RE: [SA-list] Exchange Monitoring
so what you want is that
IF 9529 is found
THEN
if 9523 is found
send alert
?
If that is what you want to do then I would do the following
(entry_1) eventlog check for 9529
(entry_2) eventlog check for 9523 (depends on eventlog cehck for
9529 being DOWN)
this means it will ONLY check for 9523 IF the entry above it is down.
There is however one situation I can see that could give a false alert.
Example
10:00:01 entry_1 is checked -> no problem
10:00:02 entry_2 is NOT checked as entry_1 is up
10:00:03 event 9523 is logged
10:00:04 event 9529 is logged
10:01:03 entry_1 is checked -> find 9529 -> DOWN (it will check ALL
entries between 10:00:01 and 10:01:03)
10:01:04 entry_2 is checked (as entry_1 is down) and see the 9523 (it
will check ALL entries between 10:00:02 and 10:01:04), although it did NOT
happen AFTER (in time) the 9529 entry
Dirk.
________________________________________
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael Letschin
Sent: Friday, May 06, 2005 4:55 PM
To: salive@woodstone.nu
Subject: [SA-list] Exchange Monitoring
Good Morning/Afternoon All,
I recently overhauled our Exchange setup and moved us to multiple storage
groups and mailbox stores. About a week ago I had a problem with 2 of my
mailbox stores and they became unmounted. After this happened we found we
needed a way to monitor the stores for this problem. Basically I want to know
the store has unmounted and stopped before the users tell me. Heres what I
have found so far:
Event ID 9529 is The Microsoft Exchange Information Store database "Storage
Group/Store Name" was stopped.
Event ID 9523 is The Microsoft Exchange Database "Storage Group/Store Name" has
been started.
Here is my problem. I was checking for the 9529 error with the eventlog com
check but I only want the page to my phone when the 9523 does not show up.
Also I only want it to page me when it shows up. Can the event log com tell if
it has already scanned a log or does it not clear the logs? Also I have
exchange clustered so when it fails over to a second server the 9529 shows and
then the 9523. While it would be nice to know that it failed over, that can be
sent to an email and I don't need to be alerted on my cell phone for it.
How is everyone else monitoring their Exchange servers? I have basically been
told find out if I can do it with SA or we will have to consider buying MOM and
well if I could save the company the money for MOM I know it would look a lot
better.
Thanks
Michael Letschin
Network Administrator
"When you have eliminated the impossible,
whatever remains, however improbable
must be the truth" -Sherlock Holmes
Registry Safe-Rent
888-881-3400
To unsubscribe from a list, send a mail message to [EMAIL PROTECTED]
With the following in the body of the message:
unsubscribe SAlive
