Event Log Test Properties - Event variable

G4meDTP · Joined: 06 Jul 2009 Posts: 11

Hello,
I am attempting to setup a test that will send an alert whenever a user exceeds their mailbox size limit. This is denoted in Event Viewer by the ID of 8528 and the Description provides the username having the trouble.
What I would like to make work is in the Event Log Test Properties page, under "Description contains", a method to check the part of the text that has the username (o=MyDomain/ou=MyOU/cn=MailUser/cn=username).

Will the variable "%username% work in this location (e.g "cn=%username%) to only compare events with the same user?

Is this possible?
Thanks.

AHM Version 8.14

KS-Soft Europe · Joined: 16 May 2006 Posts: 2832

Sorry, "NT Event Log" test method is unable to resolve macro variables in "Description" filter.

Actually, I do not completely understand what you are going to achieve. If you leave "Description" filter blank, you will be alerted each time some user exceeds his mailbox. You may place %NTEventText% variable into mail body in order to get full event description.

Regards,
Max

G4meDTP · Joined: 06 Jul 2009 Posts: 11

OK, thanks.

The point is that the test will check twice (an hour between tests) before sending an alert. Users normally resolve the issue within that time, and I only want to know if they do not.
The variable would allow me to have the test only "compare" the 2 events for the same user. Right now, the test sees one event for one user, and an hour later sees a new event for another user and sends the alert. This behavior does not allow me to see if an individual user is having trouble.

I thought I might be pushing the limits on this one. Thanks for your reply.

KS-Soft · Joined: 03 Apr 2002 Posts: 12795 Location: USA

I am afraid this is impossible. Even if we add support of the variable as test parameter this will not help at all.
E.g.
1) event generated for user1. variable is set to "user1"
2) event generated for user2. variable is set to "user2". Should HostMonitor compare user1 to user2? Ok, user1<>user2 = no alert should be started
3) event generated for user3. variable is set to "user3". What exactly should be compared now? user1 to user3? or user2 to user3?
4) event generated for user2. variable is set to "user2". What data should be compared now? user2 to user3? What about user1 that generated event some time ago?
Looks like HostMonitor should keep history of ALL events, remember user for each event, compare each new event to all previous events and so on.

I am afraid you need to create separate test for each user or use 1 test item and start alert after 1st matched event.

Regards
Alex