Monitoring User account creation and deletion.

Sainyam · Post by **Sainyam** » Thu Jan 08, 2015 11:39 pm

Hi Support,

I have setup user creation and deletion monitoring by monitoring event IDs 4720 and 4726. So whenever any user created I get an alert.
I am using AppAssure backup software and it requires to create / delete users automatically. I am trying to exclude those Replay user creation alerts.
Please help me, attached screenshots to show test configuration and alert to exclude.
https://onedrive.live.com/?cid=99DCCE13 ... %21108&v=3
https://onedrive.live.com/?cid=99DCCE13 ... %21109&v=3

KS-Soft Europe · Post by **KS-Soft Europe** » Fri Jan 09, 2015 2:54 am

Provided filter should work for you.
What HostMontior and RMA versions do you use? Do you use Passive or Active RMA agent for this test item?
Could you try the following:
1. Try to rewrite "Description contains" text or better copy it from alert e-mail.
2. Include %TestID% variable into alert e-mail and check if this is the same test item (not some copy, located in different folder) triggering the alert.

Sainyam · Post by **Sainyam** » Fri Jan 09, 2015 9:06 pm

Exact Username in the event is ReplayEngineXXX (where XXX is a any three digit nnumber) an I added description like this "ReplayEngine*", will it help?

Sainyam · Post by **Sainyam** » Sat Jan 10, 2015 2:40 am

HI,

Still not resolved. I am using HM v8.86. Currently we are not in planning to upgrade it to latest build alteast for next 2-3 months. SO please provide me work around for this.

KS-Soft Europe · Post by **KS-Soft Europe** » Mon Jan 12, 2015 8:31 am

Please do not use wildcard symbol (*).
Provided screenshots show correct test settings.
Should be: Description contains "Nothing from the list": ReplayEngine

We've rechecked code and made some tests. HostMonitor 8.86 with RMA/aRMA works as expected: correctly filters (does not detect) creation/deletion of user account like ReplayEngine123, ReplayEngine22, etc.

KS-Soft Europe · Post by **KS-Soft Europe** » Mon Jan 12, 2015 8:34 am

What RMA agent do you use? Passive or Active? RMA version?

Sainyam · Post by **Sainyam** » Mon Jan 12, 2015 8:15 pm

I am using Active RMA v3.76.

KS-Soft Europe · Post by **KS-Soft Europe** » Tue Jan 13, 2015 1:04 am

Are you sure it's active RMA version? It looks like RMA setup utility version.
HostMonitor 8.86 comes with Active RMA version 4.15
Please use all components (HostMonitor, RMA, Web Service, RCC, etc.) from one installation package.

Sainyam · Post by **Sainyam** » Mon Jan 19, 2015 10:38 pm

Hi, I found the issue, it there was copy of same test in other folder which create such issues. sorry for this.

KS-Soft Europe · Post by **KS-Soft Europe** » Tue Jan 20, 2015 7:02 am

Great.
That's why I asked you to include %TestID% variable into alert e-mail and check if this is the same test item (not some copy, located in different folder) triggering the alert.
Thank you for the notice.