NT Eventlog Reply Info only 1 time displayed

[itelio]

Hi

I'm trying to monitor account lockouts on the domain controllers. If the event that a user is locked out, a BAD is issued. Our tests only send an email after failing 3 times.

I noticed that in the first test the REPLY line shows the account with information. In the second test, no more information is output as REPLY, only the response time (1ms). I need the REPLY for the comments though.





This means that it is not the information but 1 ms that is output as a reply in the mail

Can i alternatively store the test / action result value as a comment?



I hope it is understandable what I mean

[Kris]

Hi Itelio,

We use a small vbscript for this, like so:

Code: Select all

Call PerformTest() 

FUNCTION PerformTest() 
   dim Domain, Counter, UserObj, oLockedoutUser 

   Set Domain = GetObject("WinNT://<YourDomainHere>") 
   Counter = 0 
   Domain.Filter = Array("User") 
    
   For Each UserObj In Domain 
      If UserObj.IsAccountLocked = True Then 
          
         If Counter = 0 Then 
            oLockedoutUser = UserObj.Name 
         else 
            oLockedoutUser = oLockedoutUser & " / " & UserObj.Name 
         end If 
          
         Counter = Counter + 1 
          
      End If 
   Next 
       
   If Counter > 0 Then 
      PerformTest = "Bad:" & Counter & " -> " & oLockedoutUser 
   Else 
      PerformTest = "Ok:" & Counter 
   End If 
End Function 

It will give you the number of locked out users and their accounts as result.
Maybe useful?

[KS-Soft]

I noticed that in the first test the REPLY line shows the account with information. In the second test, no more information is output as REPLY, only the response time (1ms). I need the REPLY for the comments though.

I do not see your settings but I assume you set one of the following options?

- set "Ok" status when new "Good" event detected
Status of the test item will be changed to "Ok" when HostMonitor finds new event that fits "Good" filter conditions

- set "Ok" status by acknowledgement (manually)
With this option chosen, test item will remain "Bad" until operator acknowledge status (then status will be changed to Ok)

Then 1ms Reply means there are no new "bad" events.

Regards
Alex

[KS-Soft]

Can i alternatively store the test / action result value as a comment?

Action result? No.
Test result (Reply value)? There is HM Script action, you may use SetTestParamByID command, e.g.
SetTestParamByID %TestID% commentline02 "%Reply%"

Regards
Alex

[itelio]

Hi Itelio,

We use a small vbscript for this, like so:

Code: Select all

Call PerformTest() 

FUNCTION PerformTest() 
   dim Domain, Counter, UserObj, oLockedoutUser 

   Set Domain = GetObject("WinNT://<YourDomainHere>") 
   Counter = 0 
   Domain.Filter = Array("User") 
    
   For Each UserObj In Domain 
      If UserObj.IsAccountLocked = True Then 
          
         If Counter = 0 Then 
            oLockedoutUser = UserObj.Name 
         else 
            oLockedoutUser = oLockedoutUser & " / " & UserObj.Name 
         end If 
          
         Counter = Counter + 1 
          
      End If 
   Next 
       
   If Counter > 0 Then 
      PerformTest = "Bad:" & Counter & " -> " & oLockedoutUser 
   Else 
      PerformTest = "Ok:" & Counter 
   End If 
End Function 

It will give you the number of locked out users and their accounts as result.
Maybe useful?

Hi,

thanks i'll will try this

[itelio]

H Alex,

thanks for your answer.

Currently trying it is with a separate mail profile which sends the mail after 1 time "bad".
So I can immediately see the information which is below in the status.

I currently use the following settings




I will test your suggestion and get in touch with further questions.

Thanks for the first and have a nice day

[KS-Soft]

If you need "bad" and "good" filters and actions and you want to keep "bad" status until "good" event detected then I would suggest to use "advanced" mode actions.
E.g.
bad action expression
("%SimpleStatus%"=="DOWN") and ("%Reply%" getword 2 <> 'ms')

good action expression
("%SimpleStatus%"=="UP") and ("%Reply%" getword 2 <> 'ms')

Regards
Alex