NT Event Log test

Wooltown · Post by **Wooltown** » Thu Jul 22, 2004 1:15 am

I have a question regarding the NT Event Log test

I have 2 tests; test 1 enabled and test 2 disabled as standard

Test 1 – will react on Event ID 1200, for all messages except “has a new status of 2”, if alert goes of, test 2 will be enabled and test 1 disabled.

Test 2 - will react on Event ID 1200, for message “has a new status of 2”, if alert goes of, test 1 will be enabled and test 2 disabled.

In System log I can see the following.

Message 1: Event ID 1200, has a new status of 7, test 1 will be disabled, and test 2 enabled
Message 2: Event ID 1200, has a new status of 5, nothing will happen
Message 3: Event ID 1200, has a new status of 2, test 2 will be disabled, and test 1 enabled.

Now comes the problem, when test 1 get enabled again, it continues reading from where it was disabled and therefore it will read Message 2 and disable test 1 and enable test 2.

Is there a way to have the test to read future messages only and don’t continue where it was disabled.

The test is for monitoring a disk array:
Has a new status of 7 – array failed
Has a new status of 5 – array rebuilding
Has a new status of 2 – array OK

Hope you understand my explanation.
Sven

KS-Soft · Post by **KS-Soft** » Thu Jul 22, 2004 5:07 pm

Is there a way to have the test to read future messages only and don’t continue where it was disabled.

Its impossible (in current version).
But I see workaround:
- configure Test 1 to react for message "Has a new status of 7"
- if you need receive alerts on other messages, you can setup additional test. E.g. Test 3 to react for message "Has a new status of 5". It can use the same alert profile that Test 1 is using (I think profile should disable both tests)
- profile that is assigned for Test 2 should enable both Test 1 and Test 3

Or there are too many possible error messages?

Regards
Alex

Wooltown · Post by **Wooltown** » Fri Jul 23, 2004 12:36 am

Thank you for your answer, you said impossibile in current version, will it be fixed/updated ?

It can be "has a new status of 1" to "has a new status of 13" so it isn't that many, I will make a workaround and test for all the other values instead.

KS-Soft · Post by **KS-Soft** » Sat Jul 24, 2004 3:48 pm

Thank you for your answer, you said impossibile in current version, will it be fixed/updated ?

It will not be fixed because this is correct behavior (in many cases).
But probably we can add some option... or better some command (HMScript), e.g. "ResetEventLogRefPoint <testname>"

Regards
Alex

Wooltown · Post by **Wooltown** » Sun Jul 25, 2004 11:45 pm

ResetEventLogRefPoint <testname> seems like a good idea, should work fine with me !

Regards
Sven

KS-Soft · Post by **KS-Soft** » Tue Jul 27, 2004 6:59 pm

I have added this task into "to do" list. Medium priority

Regards
Alex

KS-Soft · Post by **KS-Soft** » Thu Aug 05, 2004 4:22 pm

Done. HMScript command ResetEventLogRefPoint <testname> was implemented.
Update available at www.ks-soft.net/download/hm453.zip

If you check event log on remote system, system clocks on local and remote systems should be synchronized in order to work correctly.

Regards
Alex