Here is what a file in c:\Program Files\WhatsUp\Event\Windows Log looks like...
[Windows Log\Account Locked Up]
UI_CLSID={CLSID goes here}
WQL=select * from __instancecreationevent where targetinstance isa
'Win32_NTLogEvent'
SOURCE=Security
EVENTID=644
TYPE=4
TESTSTRING=
NUMMSGS=0
-Jason
On Wed, 11 Aug 2004 16:05:12 -0500, [EMAIL PROTECTED]
<[EMAIL PROTECTED]> wrote:
> I am wondering what events you are looking for to determine whether an
> account is locked out or not?
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Jason Dennis
> Sent: Wednesday, August 11, 2004 12:09 PM
> To: [EMAIL PROTECTED]
> Subject: [WhatsUp Forum] WinEvents
>
> I am monitoring Windows2000 and 2003 Domain Controllers in about 10
> countries using Whatsup Gold 8.03HF1. I recently added an Event to
> look for Locked out Accounts - in other words for Windows users who
> exceed their password limit and lock their domain account. All is
> working well, except I do run into some interesting problems with
> stability
>
> If the Event Log is cleared on the destination machine, then new
> events do not get polled by WMI from the Whatsup Server. Restarting
> Whatsup Gold (running as a service with domain admin rights) and/or
> restart the WinEvent.exe service on the server allows any NEW events
> to be properly captured.
>
> Has anyone else run into the problem wherein Whatsup Gold 8.03HF1
> appears to get into a state where new Windows Logs do not get captured
> ?
>
> On a side note - I also run into problems where certain maps refuse to
> poll until I restart the main Whatsup service. For example, 25 maps
> may be running just fine, but any devices in the "stale map" do not
> get polled (the map is active and each device is active). The way we
> can see this is when we add new devices to the map, they never start
> polling.
>
> Regards,
> Jason
>
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
