Hi.
I looked at what you want and found the following to work with the inverted status on.
checkevt.pl Criteria: "servername:system:1200:1:4:EventLog:id:4040" "servername:system:1200:1:4:EventLog:id:31000"
If the check finds both it returns a down status which the invert will change.
If the check finds any one of the two it returns a down status which the invert will change.
If it does not find any of the two it returns a up status which the invert will change.
Regards
Charles Callow
T-Systems South Africa (Pty) Ltd
Server Engineer Unix
Server Engineer Tivoli Support
Postal Address: P.O. Box 1, Sanlamhof, Bellville, 7532
Phone: +27 21 947 4136
Fax: +27 21 947 2791
Mobile Phone: +27 82 653 3261
E-mail: [EMAIL PROTECTED]
Internet: www.t-systems.co.za
| Dirk Bulinckx <[EMAIL PROTECTED]>
Sent by: [EMAIL PROTECTED] 2005/08/02 10:17
|
To: [email protected]@[EMAIL PROTECTED] cc: Subject: RE: [SA-list] Don't think this is possible, but ... |
Showing only the down when both are down is only possible IF you would create a totaly new check type for it. Getting the alert only when both are down can be done by putting the alert on the 2nd check. BUT it will still be a tricky thing as the 1st one will only be down for 1 cycle.
Dirk.
_____
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Irene Warden
Sent: Tuesday, August 02, 2005 10:07 AM
To: [email protected]
Subject: RE: [SA-list] Don't think this is possible, but ...
The messages are an 'either/or' each day, when the database is downloaded each day, then either it is updated successfully (4040) or it doesn't need to because the new db hasn't changed from the previous one (31000).
I've got the 31000 check dependent on the 4040 one failing, so it only checks for 'no change' if the 'new update' hasn't taken place (which is fine if there is an update). Unfortunately, it then means that if there isn't an update, and it then checks for 'no change', even if there is a successful 'no change' entry (meaning everything is up-to-date), the previous 'no update' failure still shown as a DOWN (which is true for that check, but not really true for the whole sequence).
What I would like to do is to show a DOWN only if both the 4040 and 31000 checks fail .....
[EMAIL PROTECTED]
Sent by: [EMAIL PROTECTED]
01/08/2005 16:44
To
[email protected]
cc
Subject
RE: [SA-list] Don't think this is possible, but ...
Question: will they appear at the same time (4040 and 31000) or is it possible to schedule the tests in such way that when they are tested that the both seems to appear at the same time?
Dirk.
_____
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Irene Warden
Sent: Monday, August 01, 2005 5:36 PM
To: [email protected]
Subject: [SA-list] Don't think this is possible, but ...
I have an application which should, every night, download a database from a website and use this database to update its local information. Most of this time this is what happens; however, sometimes the database which is downloaded hasn't changed, so there isn't any need to update the local information, which is also OK. Each of these actions writes to the server's event log, and I'm using the old Perl CheckEvt addon.
What I would really like to do is send an alert if there is *no* event entry for the download, and if there is *no* event entries for either the update or the 'everything's current' warning, but I don't think I can check for missing event log entries (can I?).
I've managed to fiddle the first rule, so that it sends me an email if the database downloads correctly (by finding the entry in the log, then inverting the status to it doesn't show as DOWN), but I'm not really 100% happy with it as I have to check my email each morning to see if I've received a mail, rather than getting alerted when the entry doesn't appear in the event log .....
but I'm completely stuck with the next bit ..... the problem is that either the update (event ID 4040) or the 'everything is up-to-date message (event ID 31000) are both correct, so I really only want to get an alert if *neither* one appears. The CheckEvt documentation shows how to flag if *both* entries appear, but since it doesn't mention a *neither* option, I assume I can't do it.
Does this make any sense??
For the latest data on the economy and society
consult National Statistics at http://www.statistics.gov.uk
**********************************************************************
Please Note: Incoming and outgoing email messages
are routinely monitored for compliance with our policy
on the use of electronic communications
**********************************************************************
Legal Disclaimer : Any views expressed by
the sender of this message are not necessarily
those of the Office for National Statistics
**********************************************************************
The original of this email was scanned for viruses by the Government Secure Intranet (GSi) virus scanning service supplied exclusively by Energis in partnership with MessageLabs.
On leaving the GSi this email was certified virus-free
PLEASE NOTE: THE ABOVE MESSAGE WAS RECEIVED FROM THE INTERNET.
On entering the GSi, this email was scanned for viruses by the Government Secure Intranet (GSi) virus scanning service supplied exclusively by Energis in partnership with MessageLabs.
Please see http://www.gsi.gov.uk/main/notices/information/gsi-003-2002.pdf for further details.
In case of problems, please call your organisational IT helpdesk
The original of this email was scanned for viruses by the Government Secure Intranet (GSi) virus scanning service supplied exclusively by Energis in partnership with MessageLabs.
On leaving the GSi this email was certified virus-free
