Event Log error alert...with no error in Event Log

Vanno · Post by **Vanno** » Wed May 30, 2007 2:04 pm

We have been getting Event Log alerts, and when we actually check the log, there are no errors. This is the detail in the alert.

Message not found. Insertion Strings:NTDS, 1088, NTDSA: C:\\WINDOWS\NTDS\ntds.dit

What causes this alert and how can I remedy it?

Thanks for your help!

Tyler

KS-Soft Europe · Post by **KS-Soft Europe** » Wed May 30, 2007 2:21 pm

I suppose, the test checks NT Event log on remote host, right? You should open Registry editor on remote machine, and export the key, located under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\<log name>\<event source name>
Import that key onto machine, where HostMonitor is running and copy dll, specified under EventMessageFile value name into appropriate folder. Also you may simple copy that .dll into HostMonitor's folder.

Regards,
Max

Vanno · Post by **Vanno** » Thu May 31, 2007 12:05 pm

I went to the key on the remote machine, but I am confused as to which "event source name" I should export. I went to the "Directory" key and expanded it to reveal all the NTDS source names. How do I figure out the right one? As for the DLL, would it be the one that is within that key?

Thanks

KS-Soft · Post by **KS-Soft** » Thu May 31, 2007 1:03 pm

I went to the key on the remote machine, but I am confused as to which "event source name" I should export

You have setup NT Event Log test to search for some event. HostMonitor changed status of the test, this means event fitted specified filter. What exactly test parameters have you used?
If you have not specified "event source" parameter of the test and you are using some generic filter setting like "Event type: error", HostMonitor checks for records from any software. In such case you should add some action into alert profile used by this test item (e.g. "send e-mail") and use %NTEventSource% macro variable in e-mail template to retrieve necessary information. Next time event appears, HostMonitor will send e-mail with information regarding source.

Regards
Alex