event log monitoring exceptions do not work

[hostmonitor@ibid.co.uk]

I am running the latest version of Hostmonitor enterprise (after paying money to get the upgrade which I though would sort out this issue).

The problem is that our system event log records a 'battery charging' from our dell servers. This event is an error level event and as such hostmonitor captures it and sends out an SMS text message and email from an app we have written. The issue is that we do not need these events and they often wake me up in the middle of the night with the thought that something serious is wrong.

To help stop this I changed the event log conditions in the test to put in an 'except' and entered the event id of 4098. This in theory should ignore the event and not trigger an alert. It still sends the alerts out.

This is very frustrating. The event log distinctly shows the event id to be 4098 and that is the number we put in the exception list. Please help.

[KS-Soft]

Could you please provide test settings? E.g. you may export test into text file (menu File -> Export to text file -> Export selected test(s)) and copy&paste info into the post

Regards
Alex

[hostmonitor@ibid.co.uk]

Alex,
I have removed some of the entries for security reasons

;-----------------------------------------------------------------------------
;- HostMonitor`s export/import file -
;- Generated by HostMonitor at 01/04/2005 10:38:35 -
;- Source file: XXXXXX
;- Generation mode: Selected_Tests -
;-----------------------------------------------------------------------------


; ------- Test #01 -------


Method = NTLog
;--- Common properties ---
;DestFolder = Root\SQLSERVER\
Title = NTLog \\SQLSERVER: system
Comment = NTLog \\SQLSERVER:
RelatedURL =
ScheduleMode= Regular
Schedule =
Interval = 5
Alerts = SMS Alert Event Logs
ReverseAlert= No
UnknownIsBad= Yes
UseCommonLog= Yes
PrivLogMode = Default
CommLogMode = Default
;--- Test specific properties ---
Computer = \\SQLSERVER
Log = System
Source =
Username = XXXXX
Password = XXXXX
CheckComp = Any
CheckType = AnyFromList
CheckID = AnyExceptList
CheckDescr = Any
CompList =
TypeList = Error
TypeList = Warning
TypeList = Failure audit
IDList = ^M4098^M
DescrList =
ReportMode = AllEvents

;-----------------------------------------------------------------------------
; Exported 1 tests

[KS-Soft]

I just tested HostMonitor using your settings, it works correctly.
May be you have another "NT Event Log" test that sends alerts?

BTW I would recommend to use longer test interval when you check remote systems. If you have hundreds of tests (usual configuration) and all of them are performed every 5 sec, it may produce high network traffic.

Regards
Alex

[hostmonitor@ibid.co.uk]

Alex,
It is this test which is sending them out. The error only appears in the system log and this is the only test on the system log on that machine. I cant explain it. Weird.

I will cut down the sample time. Thanks for the advice.

[KS-Soft]

I checked filter's code, looks fine.
H'm... may be HostMonitor is running in service mode and you have used another instance (application) to change test settings? If service was not restarted it still using old test settings...

Regards
Alex

[hostmonitor@ibid.co.uk]

Alex,
I will check. It is running in service mode and the test export was taken from that instance of the running service (double click on service bar to open). I will stop and start the service anyway to see what happens.

One extra nice feature would be that for any event raised, a simple click and ignore setting would be useful. It would mean that as more events occur we can simply click the event logged in HM and say ignore in future and that would be much easier than having to set each test manually.

Another benefit would be a setting saying do not alert report duplicates. we have an app with 120 threads and when the db packs up we get 120 warnings in the app event log as each one fails. Because we want all unique events alerted we do not use first bad only. But we do not want 120 emails or SMSs. HM is brilliant as if our sql db cluster fails over the threads accessing it from the app pack up. The problem is that sql takes up to 60 seconds to fail over. So we set HM to count 40 thread failures and then restart the service and by then the cluster is back and everything just carries on. HM is a fantastic piece of software. And yes e know we could code the app to deal with loss of db but it was not a priority function over other work (as always).

[KS-Soft]

One extra nice feature would be that for any event raised, a simple click and ignore setting would be useful. It would mean that as more events occur we can simply click the event logged in HM and say ignore in future and that would be much easier than having to set each test manually.

Not sure it will be implemented but I have added your suggestion into "to do" list.

Another benefit would be a setting saying do not alert report duplicates. we have an app with 120 threads and when the db packs up we get 120 warnings in the app event log as each one fails. Because we want all unique events alerted we do not use first bad only. But we do not want 120 emails or SMSs.

I think you may change "Condition to start action" from "standard" to "advanced" mode (Action Properties dialog) and use expression like ('%SimpleStatus%=='DOWN') and ('%Reply%'<>'%LastReply%')
http://www.ks-soft.net/hostmon.eng/mfra ... ncedaction
Also you should enable "Show events description in Reply field" option (Misc page in the Options dialog).

Regards
Alex