KS-Soft. Network Management Solutions
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister    ProfileProfile    Log inLog in 

NT Eventlog Reply Info only 1 time displayed

 
Post new topic   Reply to topic    KS-Soft Forum Index -> Configuration, Maintenance, Troubleshooting
View previous topic :: View next topic  
Author Message
itelio



Joined: 06 Nov 2014
Posts: 120

PostPosted: Thu Aug 27, 2020 2:19 am    Post subject: NT Eventlog Reply Info only 1 time displayed Reply with quote

Hi

I'm trying to monitor account lockouts on the domain controllers. If the event that a user is locked out, a BAD is issued. Our tests only send an email after failing 3 times.

I noticed that in the first test the REPLY line shows the account with information. In the second test, no more information is output as REPLY, only the response time (1ms). I need the REPLY for the comments though.





This means that it is not the information but 1 ms that is output as a reply in the mail

Can i alternatively store the test / action result value as a comment?



I hope it is understandable what I mean
Back to top
View user's profile Send private message
Kris



Joined: 12 May 2010
Posts: 375

PostPosted: Thu Aug 27, 2020 4:11 am    Post subject: Reply with quote

Hi Itelio,

We use a small vbscript for this, like so:

Code:

Call PerformTest()

FUNCTION PerformTest()
   dim Domain, Counter, UserObj, oLockedoutUser

   Set Domain = GetObject("WinNT://<YourDomainHere>")
   Counter = 0
   Domain.Filter = Array("User")
   
   For Each UserObj In Domain
      If UserObj.IsAccountLocked = True Then
         
         If Counter = 0 Then
            oLockedoutUser = UserObj.Name
         else
            oLockedoutUser = oLockedoutUser & " / " & UserObj.Name
         end If
         
         Counter = Counter + 1
         
      End If
   Next
       
   If Counter > 0 Then
      PerformTest = "Bad:" & Counter & " -> " & oLockedoutUser
   Else
      PerformTest = "Ok:" & Counter
   End If
End Function


It will give you the number of locked out users and their accounts as result.
Maybe useful?
Back to top
View user's profile Send private message
KS-Soft



Joined: 03 Apr 2002
Posts: 12792
Location: USA

PostPosted: Thu Aug 27, 2020 6:25 am    Post subject: Reply with quote

Quote:
I noticed that in the first test the REPLY line shows the account with information. In the second test, no more information is output as REPLY, only the response time (1ms). I need the REPLY for the comments though.

I do not see your settings but I assume you set one of the following options?

- set "Ok" status when new "Good" event detected
Status of the test item will be changed to "Ok" when HostMonitor finds new event that fits "Good" filter conditions

- set "Ok" status by acknowledgement (manually)
With this option chosen, test item will remain "Bad" until operator acknowledge status (then status will be changed to Ok)

Then 1ms Reply means there are no new "bad" events.

Regards
Alex


Last edited by KS-Soft on Thu Aug 27, 2020 6:31 am; edited 1 time in total
Back to top
View user's profile Send private message Visit poster's website
KS-Soft



Joined: 03 Apr 2002
Posts: 12792
Location: USA

PostPosted: Thu Aug 27, 2020 6:31 am    Post subject: Reply with quote

Quote:
Can i alternatively store the test / action result value as a comment?

Action result? No.
Test result (Reply value)? There is HM Script action, you may use SetTestParamByID command, e.g.
SetTestParamByID %TestID% commentline02 "%Reply%"

Regards
Alex
Back to top
View user's profile Send private message Visit poster's website
itelio



Joined: 06 Nov 2014
Posts: 120

PostPosted: Mon Aug 31, 2020 12:59 am    Post subject: Reply with quote

Kris wrote:
Hi Itelio,

We use a small vbscript for this, like so:

Code:

Call PerformTest()

FUNCTION PerformTest()
   dim Domain, Counter, UserObj, oLockedoutUser

   Set Domain = GetObject("WinNT://<YourDomainHere>")
   Counter = 0
   Domain.Filter = Array("User")
   
   For Each UserObj In Domain
      If UserObj.IsAccountLocked = True Then
         
         If Counter = 0 Then
            oLockedoutUser = UserObj.Name
         else
            oLockedoutUser = oLockedoutUser & " / " & UserObj.Name
         end If
         
         Counter = Counter + 1
         
      End If
   Next
       
   If Counter > 0 Then
      PerformTest = "Bad:" & Counter & " -> " & oLockedoutUser
   Else
      PerformTest = "Ok:" & Counter
   End If
End Function


It will give you the number of locked out users and their accounts as result.
Maybe useful?


Hi,

thanks i'll will try this
Back to top
View user's profile Send private message
itelio



Joined: 06 Nov 2014
Posts: 120

PostPosted: Mon Aug 31, 2020 1:10 am    Post subject: re Reply with quote

H Alex,

thanks for your answer.

Currently trying it is with a separate mail profile which sends the mail after 1 time "bad".
So I can immediately see the information which is below in the status.

I currently use the following settings




I will test your suggestion and get in touch with further questions.

Thanks for the first and have a nice day
Back to top
View user's profile Send private message
KS-Soft



Joined: 03 Apr 2002
Posts: 12792
Location: USA

PostPosted: Mon Aug 31, 2020 6:33 am    Post subject: Reply with quote

If you need "bad" and "good" filters and actions and you want to keep "bad" status until "good" event detected then I would suggest to use "advanced" mode actions.
E.g.
bad action expression
("%SimpleStatus%"=="DOWN") and ("%Reply%" getword 2 <> 'ms')

good action expression
("%SimpleStatus%"=="UP") and ("%Reply%" getword 2 <> 'ms')

Regards
Alex
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:   
Post new topic   Reply to topic    KS-Soft Forum Index -> Configuration, Maintenance, Troubleshooting All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Powered by phpBB © 2001, 2005 phpBB Group

KS-Soft Forum Index