Event log checking

bilsland · Joined: 23 Aug 2002 Posts: 14 Location: bilsland

Hi , I have tried to use the event to check an event which I want to keep an eye on. The trouble is that once an event comes up it goes bad and stays bad with loads of alerts.

Can't you do something like only check within the last (whatever you time check)to get a status?

KS-Soft · Joined: 03 Apr 2002 Posts: 12795 Location: USA

Sorry, I am not quite sure I understand the problem.

bilsland · Joined: 23 Aug 2002 Posts: 14 Location: bilsland

Ok , Here goes an example
I have setup an NT event log
--------------------------------------------
<b>Log source:</b>
Computer: UIC \computername
Log: Application
Event Source: blank (don't know it)
<b>Alert condition:</b>
Event type is: Succsses Audit event
Event ID equal to:1016
Descrpition contains: blank
------------------------------------------
This event alerts me when someone accesses an exchange account without being the main log on. I have set the alert to check every 15 seconds of the purpose of the test.

I access an account and the alert goes bad but the alert stays bad , this is the problem as I want to get alerted to all the accounts that get accessed so that I can log them and check later and also get an email alert each time so I can investogate straight away.

As I write this the recurrencess is on 31 and the status is still bad.

I am using 3.22

Thanks

bilsland · Joined: 23 Aug 2002 Posts: 14 Location: bilsland

To add to the last posting.

The audit check is now at 341 recurrences and it is still showing bad. I have set the profile up to report to a log file and it only shows the one that made it go bad not the seven I have done since then as a test, i.e when it stays bad for the first event it doesn't report all the others
I hope this makes sense

bilsland · Joined: 23 Aug 2002 Posts: 14 Location: bilsland

To add to the last to emails

The status has changed to good after 278 recurrences and it hasn't logged any of the events when it was bad. I has cause it to go bad again and it has done the same

Make sense?

KS-Soft · Joined: 03 Apr 2002 Posts: 12795 Location: USA

I see. I know only one reason to this behavior: you check Event Log on remote system and local and remote computers have different system time. Am I right? If yes, just synchronize timers on both systems.

Regards
Alex

bilsland · Joined: 23 Aug 2002 Posts: 14 Location: bilsland

Yes you are correct. I will set the servers to the same time and test that way and report back to you