This is what we are thinking so far... The thing is that when the machine boots until Windows starts the WinMgmt service we won't be able to connect to it via WMI. Now, at some point (less than 60 sec because that is the interval that the passive monitor checks the connections) WUG will connect and will issue a query for all *NEW* instances of WinEventLog with the setup properties.
The tricky issue is in how and when Windows will generate these event logs. If it generates them before we establish the connection and setup the query, then we will get those as they are new since we connected. If Windows generates them before we connect, they won't be captured for they are old instances. Now, what we can do to ensure that we capture all is when we freshly connect, acquire all instance (those that also match the criteria), process them, and then issue a query just for the new ones. This has a big disadvantage, though. Every time you restart WUG it will do that and will capture all instances, including the ones that have been received the previous time you ran WUG. That can cause actions to be fired again. The possible solution to this to add in a time filter in these reconnection situations. Something along the lines of "give me everything valid that is less than 120 seconds old". I have entered a Feature Request for this. Mark Symons Ipswitch, Inc Augusta GA -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Anthony Valuikas Sent: Wednesday, August 04, 2004 13:19 To: [EMAIL PROTECTED] Subject: RE: [WhatsUp Forum] WinEvents Thanks. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Symons Sent: Wednesday, August 04, 2004 12:10 PM To: [EMAIL PROTECTED] Subject: RE: [WhatsUp Forum] WinEvents I will play with this. My inititial impression is that maybe we are looking at some sort of initialisation delay. You are looking at reboot events.. so WUG would have been restablishing connectivity to that log. Mark -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Anthony Valuikas Sent: Wednesday, August 04, 2004 11:49 To: [EMAIL PROTECTED] Subject: RE: [WhatsUp Forum] WinEvents Yes. Dirty reboot and successful reboots. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark Symons Sent: Wednesday, August 04, 2004 8:50 AM To: [EMAIL PROTECTED] Subject: RE: [WhatsUp Forum] WinEvents 6006, 6008 events? -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Anthony Valuikas Sent: Saturday, July 31, 2004 10:31 To: [EMAIL PROTECTED] Subject: [WhatsUp Forum] WinEvents Is it possible to get 6006, 6008 events? I am having the hardest time getting the map to see those. I have about 10 others that I look for and they work across all maps fine but 6006, 6008 don't. ??? Tv Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
