View previous topic :: View next topic |
Author |
Message |
itelio
Joined: 06 Nov 2014 Posts: 120
|
Posted: Thu Aug 27, 2020 2:19 am Post subject: NT Eventlog Reply Info only 1 time displayed |
|
|
Hi
I'm trying to monitor account lockouts on the domain controllers. If the event that a user is locked out, a BAD is issued. Our tests only send an email after failing 3 times.
I noticed that in the first test the REPLY line shows the account with information. In the second test, no more information is output as REPLY, only the response time (1ms). I need the REPLY for the comments though.
This means that it is not the information but 1 ms that is output as a reply in the mail
Can i alternatively store the test / action result value as a comment?
I hope it is understandable what I mean |
|
Back to top |
|
|
Kris
Joined: 12 May 2010 Posts: 375
|
Posted: Thu Aug 27, 2020 4:11 am Post subject: |
|
|
Hi Itelio,
We use a small vbscript for this, like so:
Code: |
Call PerformTest()
FUNCTION PerformTest()
dim Domain, Counter, UserObj, oLockedoutUser
Set Domain = GetObject("WinNT://<YourDomainHere>")
Counter = 0
Domain.Filter = Array("User")
For Each UserObj In Domain
If UserObj.IsAccountLocked = True Then
If Counter = 0 Then
oLockedoutUser = UserObj.Name
else
oLockedoutUser = oLockedoutUser & " / " & UserObj.Name
end If
Counter = Counter + 1
End If
Next
If Counter > 0 Then
PerformTest = "Bad:" & Counter & " -> " & oLockedoutUser
Else
PerformTest = "Ok:" & Counter
End If
End Function
|
It will give you the number of locked out users and their accounts as result.
Maybe useful? |
|
Back to top |
|
|
KS-Soft
Joined: 03 Apr 2002 Posts: 12795 Location: USA
|
Posted: Thu Aug 27, 2020 6:25 am Post subject: |
|
|
Quote: | I noticed that in the first test the REPLY line shows the account with information. In the second test, no more information is output as REPLY, only the response time (1ms). I need the REPLY for the comments though. |
I do not see your settings but I assume you set one of the following options?
- set "Ok" status when new "Good" event detected
Status of the test item will be changed to "Ok" when HostMonitor finds new event that fits "Good" filter conditions
- set "Ok" status by acknowledgement (manually)
With this option chosen, test item will remain "Bad" until operator acknowledge status (then status will be changed to Ok)
Then 1ms Reply means there are no new "bad" events.
Regards
Alex
Last edited by KS-Soft on Thu Aug 27, 2020 6:31 am; edited 1 time in total |
|
Back to top |
|
|
KS-Soft
Joined: 03 Apr 2002 Posts: 12795 Location: USA
|
Posted: Thu Aug 27, 2020 6:31 am Post subject: |
|
|
Quote: | Can i alternatively store the test / action result value as a comment? |
Action result? No.
Test result (Reply value)? There is HM Script action, you may use SetTestParamByID command, e.g.
SetTestParamByID %TestID% commentline02 "%Reply%"
Regards
Alex |
|
Back to top |
|
|
itelio
Joined: 06 Nov 2014 Posts: 120
|
Posted: Mon Aug 31, 2020 12:59 am Post subject: |
|
|
Kris wrote: | Hi Itelio,
We use a small vbscript for this, like so:
Code: |
Call PerformTest()
FUNCTION PerformTest()
dim Domain, Counter, UserObj, oLockedoutUser
Set Domain = GetObject("WinNT://<YourDomainHere>")
Counter = 0
Domain.Filter = Array("User")
For Each UserObj In Domain
If UserObj.IsAccountLocked = True Then
If Counter = 0 Then
oLockedoutUser = UserObj.Name
else
oLockedoutUser = oLockedoutUser & " / " & UserObj.Name
end If
Counter = Counter + 1
End If
Next
If Counter > 0 Then
PerformTest = "Bad:" & Counter & " -> " & oLockedoutUser
Else
PerformTest = "Ok:" & Counter
End If
End Function
|
It will give you the number of locked out users and their accounts as result.
Maybe useful? |
Hi,
thanks i'll will try this |
|
Back to top |
|
|
itelio
Joined: 06 Nov 2014 Posts: 120
|
Posted: Mon Aug 31, 2020 1:10 am Post subject: re |
|
|
H Alex,
thanks for your answer.
Currently trying it is with a separate mail profile which sends the mail after 1 time "bad".
So I can immediately see the information which is below in the status.
I currently use the following settings
I will test your suggestion and get in touch with further questions.
Thanks for the first and have a nice day |
|
Back to top |
|
|
KS-Soft
Joined: 03 Apr 2002 Posts: 12795 Location: USA
|
Posted: Mon Aug 31, 2020 6:33 am Post subject: |
|
|
If you need "bad" and "good" filters and actions and you want to keep "bad" status until "good" event detected then I would suggest to use "advanced" mode actions.
E.g.
bad action expression
("%SimpleStatus%"=="DOWN") and ("%Reply%" getword 2 <> 'ms')
good action expression
("%SimpleStatus%"=="UP") and ("%Reply%" getword 2 <> 'ms')
Regards
Alex |
|
Back to top |
|
|
|