The eventlog monitoring will "already" when there is a new
entry matching whatever you set as rule.
As for the forwarding via a trap, this can be done
depending on what you set as being the return value of the eventlog check.
If the return is the eventlog entry (and NOT the number of entries
2, 2004 7:46 PM
To: [EMAIL PROTECTED]
Subject: RE: [SA-list] Event log monitoring
We're looking at this, seems to be an issue with the CATEGORY in a query.
Dirk.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of Jeff Preou
Sent: Tuesday, June 22, 2
We're looking at this, seems to be an issue with the CATEGORY in a query.
Dirk.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of Jeff Preou
Sent: Tuesday, June 22, 2004 9:57 AM
To: [EMAIL PROTECTED]
Subject: RE: [SA-list] Event log monit
Preou
Hamilton, New Zealand
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Dirk Bulinckx
Sent: Tuesday, 22 June 2004 7:46 p.m.
To: [EMAIL PROTECTED]
Subject: RE: [SA-list] Event log monitoring
It should only give the "down" for each of the o
ew Zealand
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Dirk Bulinckx
Sent: Tuesday, 22 June 2004 7:46 p.m.
To: [EMAIL PROTECTED]
Subject: RE: [SA-list] Event log monitoring
It should only give the "down" for each of the occurences of th
It should only give the "down" for each of the occurences of the Logon. If
the next check doesn't get a new entry that has a logon it will show an UP.
You can't configure it to "clear" a down by a logoff instead of a logon.
Dirk.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[
[EMAIL PROTECTED]
> Behalf Of Mark Bradshaw
> Sent: Tuesday, November 25, 2003 1:44 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [SA-list] Event Log Monitoring
>
>
> I think that's a great idea. Unfortunately I don't actually
> do sys admin work full-time anymore,
ourthouse Road, Suite 300
Chesterfield, VA 23832
804.768.9404 x123
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Richard Temple
Sent: Tuesday, November 25, 2003 10:21 AM
To: [EMAIL PROTECTED]
Subject: RE: [SA-list] Event Log Monitoring
Would it be worth everyone c
EMAIL PROTECTED] On Behalf Of Mark
BradshawSent: 25 November 2003 14:48To:
[EMAIL PROTECTED]Subject: RE: [SA-list] Event Log
Monitoring
Yeah. The number of events is a minimum, not a
maximum.
Mark BradshawSalem Web
Network[EMAIL PROTECTED]9401 Courthouse Road, Suite
300Chesterfiel
-From: Mark Bradshaw
[mailto:[EMAIL PROTECTED] Sent: 25 November 2003
14:48To: [EMAIL PROTECTED]Subject: RE: [SA-list] Event
Log Monitoring
Yeah. The number of events is a minimum, not a
maximum.
Mark BradshawSalem Web
Network[EMAIL PROTECTED]9401 Courthouse Road,
FyshSent: Tuesday, November 25, 2003 9:30 AMTo:
'[EMAIL PROTECTED]'Subject: RE: [SA-list] Event Log
Monitoring
Ahhh
- works fine. If there are two events in the last ten minutes will it still
alert then??
-Original Message-From: Mark Bradshaw
[mai
Title: Message
Ahhh -
works fine. If there are two events in the last ten minutes will it still alert
then??
-Original Message-From: Mark Bradshaw
[mailto:[EMAIL PROTECTED] Sent: 25 November 2003
13:43To: [EMAIL PROTECTED]Subject: RE: [SA-list] Event
Log Monitoring
A
Title: Event Log Monitoring
A
couple things. The -p option isn't needed for SA. It's only useful
if you're running the script manually to see what events are caught by
the criteria you specify. Second, you've told checkevt that you don't
care how many events it matches by putting an aster
13 matches
Mail list logo
