RE: [SA-list] Event Log Monitoring

[Mark Bradshaw]

Title: Event Log Monitoring

A couple things.  The -p option isn't needed for SA.  It's only useful if you're running the script manually to see what events are caught by the criteria you specify.  Second, you've told checkevt that you don't care how many events it matches by putting an asterisk in the "number" column.  In fact, the code doesn't really handle an asterisk there.  It NEEDS a number.  Probably what you want is this:

 

    moon:system:10:1:4:*:id:26

 

That says you need at least one matching event to alert.  Try that and see what it does for you.

Mark Bradshaw
Salem Web Network
[EMAIL PROTECTED]
9401 Courthouse Road, Suite 300
Chesterfield, VA 23832
804.768.9404 x123

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Tobie Fysh
Sent: Tuesday, November 25, 2003 7:10 AM
To: [EMAIL PROTECTED]
Subject: [SA-list] Event Log Monitoring

Hi Everyone,

Got a problem while trying to use the event log monitoring from http://www.networksimplicity.com/utils/#checkevt

The script that I use is:

c:\Perl\bin\perl.exe "C:\Documents and Settings\administrator\Desktop\checkevt.pl" moon:system:10:*:4:*:id:26 -p

I'm trying to catch the following error. http://www.tobiefysh.f2s.com/moon.JPG

Every time I use the command I get a errorlevel of 1 no matter if there are 30 events or no events (I've changed the time to be the last 1000000 minutes with the same problem).

Any ideas??

Regards,
Tobie Fysh
Technical Services Analyst
Borough Council of Kings Lynn & West Norfolk [BCKLWN]