No reply in event log test with RMA 3.64 version

pahan · Post by **pahan** » Wed May 07, 2008 12:15 pm

We monitor event log for specific event id on several servers with different rma versions. When rma ver 3.44 alerting, its replies with detailed description of event.Its not happens with version 3.64.Its alerting but without any desription...

examples:
ver 3.64 :

Test : NTLog :wmserver
Method: check NT Event Log
Status : Bad
Date : 05/07/2008 2:01:21 PM
Reply :

ver 3.44

Test : NTLog wmserver
Method: check NT Event Log
Status : Bad
Date : 05/07/2008 1:38:42 PM
Reply : Server gives the following warning information: 'The publishing point '---' is unable to stream from '****://*******', referenced in 'file://C:\**********'

KS-Soft · Post by **KS-Soft** » Wed May 07, 2008 12:20 pm

Cannot reproduce the problem. What version of HostMonitor do you use?

Regards
Alex

pahan · Post by **pahan** » Wed May 07, 2008 3:15 pm

Currently 7.08, i tried to update,but after install its shows exactly same version....

KS-Soft Europe · Post by **KS-Soft Europe** » Thu May 08, 2008 2:14 am

pahan wrote:Currently 7.08, i tried to update,but after install its shows exactly same version....

Do you mean, you tried to upgrade, but with no luck? Are you sure you have downloaded the latest version? Did you see any errors during installation process? HostMonitor shows errors just on the screen.

Could you provide more information, please?
- What exact EventId do you monitor? Event Source?
- What Windows are installed on the machines, where RMA are running?
- Are these RMA check the event log on the machine, where they are running, or on remote machine?

Regards,
Max

pahan · Post by **pahan** » Thu May 08, 2008 9:20 am

Yes,i tried to upgrade, with latest version and with no errors on screen.BUt after i started the aplication,it show the same version exactly.

I monitor error 327 with wmserver in Event source.Both RMA running on server 2003.
in case of 3.44 version - monitors for remote machine,same network.

3.44 RMA
internet ip ------------> internet ip

3.64- monitors for remote machine that connected with cross cable in internal LAN to RMA server

3.64RMA
Lan IP-----------------------> lan ip

pahan · Post by **pahan** » Thu May 08, 2008 9:52 am

I think i found the problem.In test from RMA 3.64 version,the logging mode is default.From other hand, there are full logging mode enabled in test from RMA 3.44.

KS-Soft · Post by **KS-Soft** » Thu May 08, 2008 11:31 am

Yes,i tried to upgrade, with latest version and with no errors on screen.BUt after i started the aplication,it show the same version exactly.

If installation program cannot overwrite exe module, it shows error.
The only possible explanation I see - you have installed new version into different folder. Could you verify that?

I think i found the problem.In test from RMA 3.64 version,the logging mode is default.From other hand, there are full logging mode enabled in test from RMA 3.44.

Logging? In your 1st post you provided text like
Test : NTLog wmserver
Method: check NT Event Log
Status : Bad
Date : 05/07/2008 1:38:42 PM
Reply : Server gives the following warning information: 'The publishing point '---' is unable to stream from '****://*******', referenced in 'file://C:\**********'
This does not look like HostMonitor's log record. I though this is record created by some action, e.g. "Send e-mail" action. So I do not see how this can be related to logging settings.
If you find mistake in configuration, that's great. If you still have the problem please explain everything in details. I am afraid we misunderstand each other.

Regards
Alex

pahan · Post by **pahan** » Fri May 09, 2008 9:49 am

Its exactly same default directory:
"C:\Program Files\HostMonitor6\"

The record created with "send email" action,you right. But why we get more information from specific machine and less from other....
The logging in Event viewer is working on both servers and shows same detailes information.

KS-Soft · Post by **KS-Soft** » Fri May 09, 2008 12:22 pm

Do you use the same alert profile for both test items?
What macro variables do you use in e-mail template?
Do you see event log description in Reply field of the test?

Regards
Alex

pahan · Post by **pahan** » Fri May 09, 2008 1:27 pm

YEs, we use same alert profile for both tests.
there are no micro variable that we use in email templates,simple smtp email with admin mode.

Do you see event log description in Reply field of the test?

Thats the point,i see full discription from server with RMA 3.44 and empty discription from RMA version. 3.64

KS-Soft · Post by **KS-Soft** » Fri May 09, 2008 1:36 pm

there are no micro variable that we use in email templates,simple smtp email with admin mode

If you do not use macro variables, how can you see event description??? This is impossible. May I see your template?

Thats the point,i see full discription from server with RMA 3.44 and empty discription from RMA version. 3.64

Sorry, we cannot reproduce the problem.

Regards
Alex

pahan · Post by **pahan** » Fri May 09, 2008 2:09 pm

This can help ?

Message from HostMonitor (host changed status)

Test : %TestName%
Method: %TestMethod%
Status : %STATUS%
Date : %DATETIME%
Reply : %Reply%

Recurrences : %Recurrences%
Last status: %LastStatus%
Total tests: %TotalTests%
Alive ratio : %AliveRatio%
Dead ratio: %DeadRatio%

Folder: %Folder%

KS-Soft · Post by **KS-Soft** » Fri May 09, 2008 2:43 pm

There are some NT Event Log specific variables:
%NTEventSource% - Event source. Identifies the software that logged the event
%NTEventComp% - Name of the computer where the event occurred
%NTEventTime% - Time of the event
%NTEventType% - Type of the event
%NTEventID% - Event identifier
%NTEventText% - Event description
%NTEventUser% - Represents the user name if an event is attributed to a specific user

Could you add %NTEventTime% and %NTEventText% variables?

Thats the point,i see full discription from server with RMA 3.44 and empty discription from RMA version. 3.64

What about status of the test item performed by RMA 3.64? Ok? Bad? Unknown?

Regards
Alex

pahan · Post by **pahan** » Tue May 13, 2008 10:22 am

Status is bad,becouse i configured it to be bad when the spicial event 327 is found.

I can add those fields but the same "email alert template" workes good for another RMA agent and reply is full with description...I'll try..

KS-Soft · Post by **KS-Soft** » Tue May 13, 2008 5:29 pm

I can add those fields but the same "email alert template" workes good for another RMA agent and reply is full with description

Its better to use special variables for NT Event Log test because value of Reply field may depend on some options and there are more restrictions for value of this field.
However I am not sure this will help in your case. The problem is we do not see any problems on our systems. We cannot reproduce this problem.
Could you try to setup some NT Event Log test item to search for different kind of event? Will it work?

BTW: Could you please send your registration name or order number to support@ks-soft.net? We cannot find you e-mail address in our registration database.

Regards
Alex