Event Log Monitoring - Issue with whitespace in event log name

I'm trying to setup an event log monitor for a Symantec Enterprise Vault Server, to alert on a few critical error messages. Unfortunately i've been battling with this for ages as it will not detect any errors in the custom event log for the application.

I have finally discovered an admission from Symantec that they have spelt the custom event log name incorrectly, it's name is "Enterprise Vault " (note the additional space on the end), which they have discovered is causing problems for various monitoring tools, as they just ignore the whitespace character on the end. From the behaviour i'm seeing this appears to be the cause of the problem with monitoring it in APM.

Can anyone tell me if there is a way to get APM to recognise the whitespace at the end of the name? I have tried encapsulating it in quotation marks, but this doesnt seem to have helped.

As an additional comment for the Solarwinds guys, would it be possible to add a feature request to get the Event Log Monitor to test whether it can find the custom event log specified, as at present it just says it can't find a match for the event, which makes testing the monitor quite awkward at times!

Thanks,

Paul

Find more posts tagged with

Accepted answers

Jason.Henson

Paul,

You could also push the events to Orion via a SysLog and let Orion take action on the event once it receives it. You would use the 'Log Forwarder for Windows' utility (available from your customer portal under Additional Components > Download Orion NPM Components). This tool installs on your Wndows server and runs as a service. It translates Windows events into SysLogs and then can forward them Orion. Orion then receives them and you can build rules to alert on them as they are received. You are also able to retain these events in the database for reporting as a bonus.

Thanks,
Jason Henson
Loop1 Systems
www.Loop1Systems.com

All comments

jiri.tomek

Hello Paul,
unfortunately there is currently no way how to achieve this with Event log monitor in APM. Event log name is trimmed to remove any white characters for beginning and end of log name so you can't query event logs that starts or ends with space.

However you can try to make a custom windows script where you can use custom WMI query to get data from that event log.

Such query can look like this:
SELECT EventCode, Message FROM Win32_NTLogEvent WHERE LogFile = 'Enterprise Vault ' AND EventCode = ... AND Type='Error' AND ...

Jason.Henson

Paul,

Thanks,
Jason Henson
Loop1 Systems
www.Loop1Systems.com

Paul_Yarwood

Jason & Jiri,

Thanks for your comments, both look like viable approaches, i'll give it a try.

Thanks for the help.

Paul