Time sensitive tests -- event log?

[avery_larry]

I feel guilty posting this question--it feels like I'm asking someone else to do my job. But I'm having trouble so here goes:

I'm trying to monitor my Arcserve backup jobs with hostmonitor. Arcserve can send status notifications via email or the windows event log or snmp.

There doesn't seem to be a native way to check for an email and then test based on subject or message contents.

SNMP just seems too confusing.

So I thought I'd try the event log. My problem is that there doesn't seem to be any way to check for the ABSENCE of a new event. In other words, I want to be alerted on Tuesday morning if there is NO event log from Monday night's backup. Is there a way or am I stuck finding some external method of monitoring my backups?

[Stoltze]

I'm trying to monitor my Arcserve backup jobs with hostmonitor. Arcserve can send status notifications via email or the windows event log or snmp.

Can ArcServe wirte a log file, which you can search for messages in? And you can check for the existence and age of the file as well..

[avery_larry]

Can ArcServe wirte a log file, which you can search for messages in? And you can check for the existence and age of the file as well..

Not really. There's one giant text log file for all jobs. It's about the same as using the event log. If I want to do that I'll just program a .cmd file to parse it all myself.

[Stoltze]

There's one giant text log file for all jobs. It's about the same as using the event log.

And it doesn't write in the event log when the job goes bad...?

[avery_larry]

And it doesn't write in the event log when the job goes bad...?

Well sure it does. But it doesn't write to the event log when the backup server crashes and the job doesn't run at all. THAT's what I care about. The ABSENCE of an event in the event log signifies a problem.

[Stoltze]

But it doesn't write to the event log when the backup server crashes and the job doesn't run at all. THAT's what I care about. The ABSENCE of an event in the event log signifies a problem.

Well.. Then a test that searches the event log for errors, and another test that check the age of your logfile might be your solution...? Since I'm assuming that the logfile won't be updated when the server crashes...

Otherwise might be some others in here have a solution for you..

[KS-Soft]

As I know Arcserve can send SNMP Trap messages. So, SNMP Trap test method probably the best solution.

However if you want to check Event Log, no problem. You just need to set "Reverse alert" option of the test. In such case HostMonitor will set "Bad" status if there is no new event detected in the log.

Regards
Alex

[avery_larry]

As I know Arcserve can send SNMP Trap messages. So, SNMP Trap test method probably the best solution.

Any example of that? It would basically need to alert if there were no new messages in the last 36 hours OR if the message was a failure.

However if you want to check Event Log, no problem. You just need to set "Reverse alert" option of the test. In such case HostMonitor will set "Bad" status if there is no new event detected in the log.

What defines a "new" event? Within the past 24 hours? Does HM keep a database of the events that it has seen already? Is there an example because that doesn't make sense to me.

[KS-Soft]

What defines a "new" event? Within the past 24 hours?

New event - event that was recorded after last test probe. If test is running every 24 hours, then yes - new event(s) are the events that were recorded in last 24 hours.
Please check the following part of the manual: http://www.ks-soft.net/hostmon.eng/mfra ... m#chkNTLog

Does HM keep a database of the events that it has seen already

It does not need to keep a database. It simply keeps information about last checked record in the log. If record #N was already checked then record #N-1 was checked as well.

Is there an example because that doesn't make sense to me.

Example? Do you know what kind of event recorded by Arcserve? If yes then setup test and mark "Reverse alert" option. That is. If not, I have to find Arcserve manual...

Regards
Alex

[avery_larry]

I think I was reading the hostmonitor version 3.7 (which I recently upgraded from) manual about event log checking. I think its only options were to check the most recent event (even if it had already been checked), or to check all events (either way--that matched the given criteria/filters).

I'll research the current version and post again if I have problems.

Thank you.

[KS-Soft]

3.70? This is very very old version.

I think its only options were to check the most recent event (even if it had already been checked), or to check all events (either way--that matched the given criteria/filters)

These options have different meaning. It defines HostMonitor behavior when it finds several "new" events. It does not really matter in your case however I would recommend to use "Report about last Bad/Good event" (its more simple).

In my previous post I put link to latest version of the manual.
http://www.ks-soft.net/hostmon.eng/mfra ... m#chkNTLog

Are you really using version 3.70?? This version provides NT Event Log test method and "Reverse alert" option as well. Probably you can use it but I do not remember details, its just too old (5 years old I think).

Regards
Alex

[avery_larry]

Are you really using version 3.70??

Not anymore. I just upgraded. But at the time I was reading the help pages on the old version. It definitely wasn't clear about the ability to look at "new" events. (I don't know if it was able to or not--but it definitely wasn't clear.)

Thank you.