Event Log Check - Unknown Status

CliveAllen · Joined: 24 May 2004 Posts: 6

It would seem after applying the security patch for the Sasser virus I can no longer use the Event Log check. I only receive an Unknown status. I am running version 3.71 of Host Monitor.

The security patch was applied to the machine which has Host Monitor installed and the servers it is checking. I have however tested the check against a server which does not have the security patch applied and I still get the same Unknown status.

Could there be something else that is causing the problem other than the Sasser security fix I applied?

What can I do to fix this probem other than uninstalling the Sasser fix?

Thanks in advance!

KS-Soft · Joined: 03 Apr 2002 Posts: 12793 Location: USA

We have installed this patch as well. KB835732, right?
NT Event Log test method still work...
May be you have reconfigured IP Filtering or something like that?

Regards
Alex

CliveAllen · Joined: 24 May 2004 Posts: 6

Yes thats the same patch we installed.

I forgot to say that HostMonitor is installed on a Windows 2000 Proffesional (Norwegian Version) machine.

There is no IP Filtering setup and pinging the server works just fine as does the disk space and HTTP check agqainst the same server.

Is there any way I can have more detailed error message logging so that I can see why HostMonitor comes back with an Unknown status?

Thanks

Clive

CliveAllen · Joined: 24 May 2004 Posts: 6

Ok, I have come one step futher in that I have managed to get this to work against some other servers but not the 2 I really need to monitor (A Microsoft Cluster - Windows 2000 Advanced Server).

Does anyone know how I can find out why this is?

mpriess · Joined: 02 Jul 2002 Posts: 112 Location: Arizona, USA

I have had the same thing occur in some instances - usually some event log or perf counter tests go to unkown status sometimes and the only way I've found to clear it up is to restart the advanced hostmonitor service. It seems to flush out whatever is causing the issue. However, I have also noticed a few servers that do have corrupt system logs. You may want to check that. Look at the server event log (whichever one you are checking - appplication, system or security) with the event viewer and see if a default document icon comes up where the event logs should be.

KS-Soft · Joined: 03 Apr 2002 Posts: 12793 Location: USA