Event Log Check - Unknown Status

CliveAllen · Post by **CliveAllen** » Mon May 24, 2004 3:02 am

It would seem after applying the security patch for the Sasser virus I can no longer use the Event Log check. I only receive an Unknown status. I am running version 3.71 of Host Monitor.

The security patch was applied to the machine which has Host Monitor installed and the servers it is checking. I have however tested the check against a server which does not have the security patch applied and I still get the same Unknown status.

Could there be something else that is causing the problem other than the Sasser security fix I applied?

What can I do to fix this probem other than uninstalling the Sasser fix?

Thanks in advance!

KS-Soft · Post by **KS-Soft** » Mon May 24, 2004 4:02 pm

We have installed this patch as well. KB835732, right?
NT Event Log test method still work...
May be you have reconfigured IP Filtering or something like that?

Regards
Alex

CliveAllen · Post by **CliveAllen** » Tue May 25, 2004 12:13 am

Yes thats the same patch we installed.

I forgot to say that HostMonitor is installed on a Windows 2000 Proffesional (Norwegian Version) machine.

There is no IP Filtering setup and pinging the server works just fine as does the disk space and HTTP check agqainst the same server.

Is there any way I can have more detailed error message logging so that I can see why HostMonitor comes back with an Unknown status?

Thanks

Clive

CliveAllen · Post by **CliveAllen** » Tue May 25, 2004 1:49 am

Ok, I have come one step futher in that I have managed to get this to work against some other servers but not the 2 I really need to monitor (A Microsoft Cluster - Windows 2000 Advanced Server).

Does anyone know how I can find out why this is?

mpriess · Post by **mpriess** » Tue May 25, 2004 6:52 am

I have had the same thing occur in some instances - usually some event log or perf counter tests go to unkown status sometimes and the only way I've found to clear it up is to restart the advanced hostmonitor service. It seems to flush out whatever is causing the issue. However, I have also noticed a few servers that do have corrupt system logs. You may want to check that. Look at the server event log (whichever one you are checking - appplication, system or security) with the event viewer and see if a default document icon comes up where the event logs should be.

KS-Soft · Post by **KS-Soft** » Tue May 25, 2004 11:22 am

Is there any way I can have more detailed error message logging so that I can see why HostMonitor comes back with an Unknown status?

You may use RMA to perform the test (even RMA installed on local system), it will return error description.
Next version of HostMonitor will work in the same way

Regards
Alex

Event Log Check - Unknown Status

Event Log Check - Unknown Status

Try stopping and restarting the hostmonitor service.