RE: [SA-list] Event Log Monitoring

[Tobie Fysh]

Title: Message

That's brilliant - whole thing is working fine now!

 

Another string to the Servers Alive bow. Now if only I could convince management to upgrade to the Enterprise Version I could have some fun with the database stuff I hear about!!

 

Tobie

-----Original Message-----
From: Mark Bradshaw [mailto:[EMAIL PROTECTED]
Sent: 25 November 2003 14:48
To: [EMAIL PROTECTED]
Subject: RE: [SA-list] Event Log Monitoring

Yeah.  The number of events is a minimum, not a maximum.

Mark Bradshaw
Salem Web Network
[EMAIL PROTECTED]
9401 Courthouse Road, Suite 300
Chesterfield, VA 23832
804.768.9404 x123

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Tobie Fysh
Sent: Tuesday, November 25, 2003 9:30 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [SA-list] Event Log Monitoring

Ahhh - works fine. If there are two events in the last ten minutes will it still alert then??

-----Original Message-----
From: Mark Bradshaw [mailto:[EMAIL PROTECTED]
Sent: 25 November 2003 13:43
To: [EMAIL PROTECTED]
Subject: RE: [SA-list] Event Log Monitoring

A couple things.  The -p option isn't needed for SA.  It's only useful if you're running the script manually to see what events are caught by the criteria you specify.  Second, you've told checkevt that you don't care how many events it matches by putting an asterisk in the "number" column.  In fact, the code doesn't really handle an asterisk there.  It NEEDS a number.  Probably what you want is this:

 

    moon:system:10:1:4:*:id:26

 

That says you need at least one matching event to alert.  Try that and see what it does for you.

Mark Bradshaw
Salem Web Network
[EMAIL PROTECTED]
9401 Courthouse Road, Suite 300
Chesterfield, VA 23832
804.768.9404 x123

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Tobie Fysh
Sent: Tuesday, November 25, 2003 7:10 AM
To: [EMAIL PROTECTED]
Subject: [SA-list] Event Log Monitoring

Hi Everyone,

Got a problem while trying to use the event log monitoring from http://www.networksimplicity.com/utils/#checkevt

The script that I use is:

c:\Perl\bin\perl.exe "C:\Documents and Settings\administrator\Desktop\checkevt.pl" moon:system:10:*:4:*:id:26 -p

I'm trying to catch the following error. http://www.tobiefysh.f2s.com/moon.JPG

Every time I use the command I get a errorlevel of 1 no matter if there are 30 events or no events (I've changed the time to be the last 1000000 minutes with the same problem).

Any ideas??

Regards,
Tobie Fysh
Technical Services Analyst
Borough Council of Kings Lynn & West Norfolk [BCKLWN]