Event Logs Filter by Description

ChrisC · Post by **ChrisC** » Fri Oct 10, 2008 2:13 pm

I was curious if there was a way to filter messages by the description. We have an app we only want certain messages to be emailed to developers for. the body of the description is a long bunch of text. Is there any way to filter using wild cards.

Example..

TestCompany453.something.something 2342 stopped and unavailable

453*stopped

Something similar in the description filters it should email this message to our developers.

Thanks.

KS-Soft · Post by **KS-Soft** » Fri Oct 10, 2008 2:37 pm

Not sure I understand the question. How HostMonitor checks these "messages"? What test method do you use? NT Event Log? Text Log? SNMP Trap?

Regards
Alex

ChrisC · Post by **ChrisC** » Fri Oct 10, 2008 6:24 pm

yea. this would be using the NT Event Log test. Sorry.

KS-Soft · Post by **KS-Soft** » Fri Oct 10, 2008 7:58 pm

Sorry, I missed topic theme.

Sure, you may filter events by description. As you may see there is "Description contains" filter. You can provide list of the text strings (phrases) and choose one of the options:
- Any text
event description doesn't matter (event with any description can be** considered as "Bad")
- Any string from the list
event can be** considered as "Bad" when description contains ANY string from the list
- Nothing from the list
event can be** considered as "Bad" when description does not contain ANY string from the list
- All strings from the list
event can be** considered as "Bad" when description contains ALL strings from the list
---------
** when we say "can be**", we mean event WILL BE considered as "Bad" WHEN IT MATCHES ALL specified requirements.

Regards
Alex

ChrisC · Post by **ChrisC** » Mon Oct 13, 2008 8:01 am

What i need is more of a wild card.

I would like to make multiple matches in the same test if possible. If not then ill just have to make seperate tests.

I would like to put something like the following lines in the test.

800*Stop
560*Exception

ex match... "Company800xinvalid.Temp.Condition Stop"
ex match... "Company560.total.time Unhandled Exception"

ex not match... "Company800xinvalid.time.bla bla Exception"
ex not match... "Company560.total.Files.error Stop"

is that possible to do in 1 test, or does that have to be broken out? It doesnt seem possible without some sort of wild card using the rules you posted.
Thanks.

KS-Soft · Post by **KS-Soft** » Mon Oct 13, 2008 10:01 am

I would like to put something like the following lines in the test.
800*Stop
560*Exception

This is posible but you may need to create 2 test items:
- 1 test to check for "560" and "Exception"
- 2nd test to check for "800" and "Stop" lines.

Regards
Alex

ChrisC · Post by **ChrisC** » Mon Oct 13, 2008 11:37 am

I was hoping to keep it simple but thats not too bad. Thanks for the quick replys.