Dirk,
For point 1., I seem to be seeing a different outcome, ie. SA starts up and
COM check scans the event log but I always get a DOWN followed by an UP the
following cycle, ie. the fact that a matching event log entry exists in the
event log *somewhere* is being picked up by the COM check. I also seem to
be seeing two instance of the check being performed in the first cycle, one
at the expected time in the cycle and then again at the end as though a SK
has been invoked. It is this 2nd attempt which is then generating the DOWN.
I've sent a log extract off-list.
Cheers,
Anthony
"Dirk Bulinckx"
<[EMAIL PROTECTED]
u> To
Sent by: <[EMAIL PROTECTED]>
[EMAIL PROTECTED] cc
stone.nu
Subject
RE: [SA-list] Event Log COM check
08/07/2004 04:37 questions
PM
Please respond to
[EMAIL PROTECTED]
nu
1. The COM check get the "recordnumber" of the newest eventlog entry and
keep that, and that is what is done in the initial check, if it's able to
do
that it will give an UP.
2. Your pointing to the exact reason why I was always opposed (and basicly
still am) to doing eventlog checks. A down is clear and up isn't. In the
eventlog most apps won't log when all is well, only when it's not ok.
Don't
think there is a good solution for it. Maybe explain that to the
non-understanding tech people.
Dirk.
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf
Of [EMAIL PROTECTED]
Sent: Thursday, July 08, 2004 12:15 AM
To: [EMAIL PROTECTED]
Subject: [SA-list] Event Log COM check questions
I'm using the Event Log COM check v1.0.0.7 with SA 4.1.1618 and there's a
couple of issues around the way it works that I'd appreciate any advise on.
The check I have setup is a simple "Give a DOWN condition when 'at least
one' new event log entry matches".
1. When SA first starts up and the check establishes it's initial
checkpoint it usually finds a match to generate a DOWN condition that we
have previously been alerted to since our event log (in this case the
System Event log) takes weeks to roll over, ie. the event entry could be
2-3 weeks old. Is there any way of having the COM check know that SA has
just started and therefore while establishing it's initial event log
checkpoint NOT to generate a down condition? If not, could this be a
feature request (or possibly a bug submission depending on your point of
view)?
2. Because the Event Log check is going to always generate an UP condition
in the cycle after a DOWN condition *unless* the event log entry is
repeated, and for the check I'm doing there is no corresponding event entry
to indicate an UP condition after the DOWN, I have a constant problem with
other admins seeing a DOWN alert followed by an UP alert the following
cycle (as expected) and then interpreting this as a "glitch" and everything
is OK. I know this comes under "educating admins" but I'm wondering if
anyone has any creative ideas on how to prolong the DOWN condition alerts
I'd appreciate the thoughts.
Cheers,
Anthony
The information contained in this email message and any attachment is for
intended recipients only. It may contain confidential, privileged or
copyright material. If you receive this email in error please delete it
and any attachments and notify the sender immediately by reply email. Any
use, reading, copying, distributing or disclosure of the information in
this email is strictly prohibited if you are not the intended recipient.
Any views expressed in this email are not necessarily those of TNT. TNT
does not warrant that this email is free from viruses or other defects.
TNT is not liable for loss, damage or other consequences that may arise
from opening or using this email or any attachments.
"TNT" means TNT Australia Pty Limited, its related companies and
subsidiaries and includes McPhee Transport Pty Ltd, Riteway Transport Pty
Limited, TNT Materials Handling Pty Ltd and TNT Logistics (Australia) Pty
Limited.NfAw~?z
% N ry b ??j)fz?h+- 'z{?m? Z0x"^n?razg ?{.n+?X
--------------
[This E-mail scanned for viruses by Declude Virus]
To unsubscribe from a list, send a mail message to [EMAIL PROTECTED]
With the following in the body of the message:
unsubscribe SAlive
The information contained in this email message and any attachment is for
intended recipients only. It may contain confidential, privileged or
copyright material. If you receive this email in error please delete it
and any attachments and notify the sender immediately by reply email. Any
use, reading, copying, distributing or disclosure of the information in
this email is strictly prohibited if you are not the intended recipient.
Any views expressed in this email are not necessarily those of TNT. TNT
does not warrant that this email is free from viruses or other defects.
TNT is not liable for loss, damage or other consequences that may arise
from opening or using this email or any attachments.
âTNTâ means TNT Australia Pty Limited, its related companies and
subsidiaries and includes McPhee Transport Pty Ltd, Riteway Transport Pty
Limited, TNT Materials Handling Pty Ltd and TNT Logistics (Australia) Pty
Limited.
