Monitor the event log on a bunch of XP systems on DHCP

All questions related to installations, configurations and maintenance of Advanced Host Monitor (including additional tools such as RMA for Windows, RMA Manager, Web Servie, RCC).
Post Reply
invisik
Posts: 34
Joined: Mon Jan 15, 2007 10:35 pm

Monitor the event log on a bunch of XP systems on DHCP

Post by invisik »

Hi!

Ok, wondering how this could be done.

I have a number of offices with their Windows XP desktop machines running DHCP on a Windows Active Directory domain setup. I believe I can use the "Domain\Administrator" naming to authenticate to any system on the network from HostMonitor, which is great.

I would like to check all of the XP systems event logs once a day for Errors. Can I specify an IP range for NT Log to check and have it return the IP (or ideally the hostname) of the machines it is checking? I would need some way to find out what machine had an error.

What's the best wayt to poll a large number of desktop systems without setting each one up individually?

Thanks! Everytime I look at my HostMonitor it does something else new! :)

-m
KS-Soft Europe
Posts: 2832
Joined: Tue May 16, 2006 4:41 am
Contact:

Re: Monitor the event log on a bunch of XP systems on DHCP

Post by KS-Soft Europe »

invisik wrote:I have a number of offices with their Windows XP desktop machines running DHCP on a Windows Active Directory domain setup. I believe I can use the "Domain\Administrator" naming to authenticate to any system on the network from HostMonitor, which is great.
Correct.
invisik wrote:I would like to check all of the XP systems event logs once a day for Errors. Can I specify an IP range for NT Log to check and have it return the IP (or ideally the hostname) of the machines it is checking? I would need some way to find out what machine had an error.

What's the best wayt to poll a large number of desktop systems without setting each one up individually?
"NT Event Log" test method does not support range of target IP's. You should create separate test for each certain XP box. In this case, I think, "Replicator utility" will be helpful.
Quote from he manual:
http://www.ks-soft.net/hostmon.eng/replicator/index.htm
===================================
Those who have large networks with hundreds of servers will appreciate the ability to replicate a test (i.e. reproduce and apply to...) for an array of systems in almost an instant. For example if you have a CPU Usage test that works on one machine, with the help of a Replicator you may reproduce the same test for every workstation without a hassle of setting the parameters of each of them separately.
===================================

So, in your case, you just should create one "NT Event Log" test to check one specific XP box and use Replicator to create the same tests for other XP boxes.

Probaly, for the DHCP network, it would be better to use HostNames instead of IP. However, if you specify IP-adresses it should work as well. It is up to you.
To resolve, what exact XP box has an error, you should assign to the tests action profile, that uses "NT Event Log" specific macro variables:
Quote from the manual:
http://www.ks-soft.net/hostmon.eng/mfra ... .htm#macro
================
the following variables have sense for "NT Event Log" test only, they represent parameters of the last "Bad" event detected:
%NTEventSource% Event source. Identifies the software that logged the event
%NTEventComp% Name of the computer where the event occurred
%NTEventTime% Time of the event
%NTEventType% Type of the event
%NTEventID% Event identifier
%NTEventText% Event description
%NTEventUser% Represents the user name if an event is attributed to a specific user
================
invisik wrote:Thanks! Everytime I look at my HostMonitor it does something else new! :)
You are welcome! ;-)

Regards,
Max
KS-Soft Europe
Posts: 2832
Joined: Tue May 16, 2006 4:41 am
Contact:

Re: Monitor the event log on a bunch of XP systems on DHCP

Post by KS-Soft Europe »

invisik wrote:Thanks! Everytime I look at my HostMonitor it does something else new! :)
BTW. There is a special branch in the forum, where you may post your opinion: http://www.ks-soft.net/cgi-bin/phpBB/viewforum.php?f=12

Your opinion is greatly appreciated. ;-)

Regards,
Max
invisik
Posts: 34
Joined: Mon Jan 15, 2007 10:35 pm

Post by invisik »

Wow, that's great. I will try it in the coming week. Thanks.

One additional question, I would not like an error returned if the XP machine cannot be contacted. This particular site has many laptops which are not always at their desk. I just want to see event logs when the machines are there.....

Thanks!

-m
KS-Soft
Posts: 13012
Joined: Wed Apr 03, 2002 6:00 pm
Location: USA
Contact:

Post by KS-Soft »

Does "I would not like an error returned" mean "I do not want to start actions"? Then disable "Treat Unknown status as Bad" option of the test

Regards
Alex
invisik
Posts: 34
Joined: Mon Jan 15, 2007 10:35 pm

Post by invisik »

Ok, I'm finally getting a chance to try my DHCP monitoring.

I am unable to connect to a desktop machine with the domain administrator credentials, even after port 135 and 445 are opened in Windows Firewall. The error is: RMA: 301 - Win32 Error. Code: 5. I am able to use the Event Viewer program on the server and open the other computer and view the event log successfully.

I know code 5 is authentication failure, but I've tried a number of different combinations of Domain\Administrator with no success.

Any other suggestions? I am on 6.7.5 still.

Thanks.

-m
KS-Soft Europe
Posts: 2832
Joined: Tue May 16, 2006 4:41 am
Contact:

Post by KS-Soft Europe »

I suppose, the desktop machine is running under Windows XP? In such case, you may try to disable "Simple File Sharing" option, located in "My computer" -> "Tools" -> "Folder options" -> "View" menu.

It might help.

Regards,
Max
Post Reply