1. The COM check get the "recordnumber" of the newest eventlog entry and keep that, and that is what is done in the initial check, if it's able to do that it will give an UP. 2. Your pointing to the exact reason why I was always opposed (and basicly still am) to doing eventlog checks. A down is clear and up isn't. In the eventlog most apps won't log when all is well, only when it's not ok. Don't think there is a good solution for it. Maybe explain that to the non-understanding tech people.
Dirk. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Thursday, July 08, 2004 12:15 AM To: [EMAIL PROTECTED] Subject: [SA-list] Event Log COM check questions I'm using the Event Log COM check v1.0.0.7 with SA 4.1.1618 and there's a couple of issues around the way it works that I'd appreciate any advise on. The check I have setup is a simple "Give a DOWN condition when 'at least one' new event log entry matches". 1. When SA first starts up and the check establishes it's initial checkpoint it usually finds a match to generate a DOWN condition that we have previously been alerted to since our event log (in this case the System Event log) takes weeks to roll over, ie. the event entry could be 2-3 weeks old. Is there any way of having the COM check know that SA has just started and therefore while establishing it's initial event log checkpoint NOT to generate a down condition? If not, could this be a feature request (or possibly a bug submission depending on your point of view)? 2. Because the Event Log check is going to always generate an UP condition in the cycle after a DOWN condition *unless* the event log entry is repeated, and for the check I'm doing there is no corresponding event entry to indicate an UP condition after the DOWN, I have a constant problem with other admins seeing a DOWN alert followed by an UP alert the following cycle (as expected) and then interpreting this as a "glitch" and everything is OK. I know this comes under "educating admins" but I'm wondering if anyone has any creative ideas on how to prolong the DOWN condition alerts I'd appreciate the thoughts. Cheers, Anthony The information contained in this email message and any attachment is for intended recipients only. It may contain confidential, privileged or copyright material. If you receive this email in error please delete it and any attachments and notify the sender immediately by reply email. Any use, reading, copying, distributing or disclosure of the information in this email is strictly prohibited if you are not the intended recipient. Any views expressed in this email are not necessarily those of TNT. TNT does not warrant that this email is free from viruses or other defects. TNT is not liable for loss, damage or other consequences that may arise from opening or using this email or any attachments. "TNT" means TNT Australia Pty Limited, its related companies and subsidiaries and includes McPhee Transport Pty Ltd, Riteway Transport Pty Limited, TNT Materials Handling Pty Ltd and TNT Logistics (Australia) Pty Limited.NfAw~?z % N ry b ??j)fz?h+- 'z{?m? Z0x"^n?razg ?{.n+?X -------------- [This E-mail scanned for viruses by Declude Virus] To unsubscribe from a list, send a mail message to [EMAIL PROTECTED] With the following in the body of the message: unsubscribe SAlive
