SAM Event Log monitor, not working with keyword

dkohler

I have an event log monitor that works, unless I add keyword matching.

In the section Include events:, I enter "Cannot Create Thread"

The event description comes across as:

File: This is a test - Reason Cannot Create Thread. error: The operation completed successfully.

Line: %2.

Reason: %3

Am I missing something? Besides the fact that the error is that it completes successfully...

Running SAM 6.9.1

Find more posts tagged with

correctanswer

mvp

thanks

protip

Accepted answers

dkohler

I turned on debug logging. I looked at the log, and ran the wmi query manually. Apparently WMI is not reading the message from the event logs, that column is blank, which would explain why it matches nothing. sigh... thanks everyone for your input!

All comments

sturdyerde

Can you add a screen shot of your component monitor definition?

dkohler

Added screenshot to post. Thanks for taking a look!

sturdyerde

Cool. So when it works without your keyword filter ("Cannot Create Thread") is it just alerting on all events that get logged to the "Ajax" log?

sturdyerde

Oh, and which log do your Ajax events get sent to? Are they in the Windows Application logs, or in their own log under Applications and Services Logs?

dkohler

When I remove "Cannot Create Thread", it alerts on all entries with the event ID 3045 in the Ajax log. And it is under Application and Services Logs.

shuth

With the Windows Event Log monitor, make sure all the following fields are correct:

The Custom Log to Monitor matches the name under Applications and Services Logs tree
Match Definition is Custom and the Event ID is set to Match only specific IDs and the ID is entered
Event Type should match the error level or set to any event if multiple types can occur

As a quick test, I set up an event log monitor for the SolarWinds.Net log and shutdown the Log Manager services - this causes 3 error events - with an application monitor specifically looking at the trap service entry. With the Include Events as "Trap Service" I only get the 1 event (Correct) and with the Include Events section blank I get the 3 events (Correct).

The highlighted fields should match between your event log and the component monitor configuration.

Removing the Include Events filter:

These are the event logs generated from the test and you can see how the testing picked up the three 1006 events and the single 1006 event that contained "Trap Service".

1006 - the 3 services shutting down
1003 - the 3 services starting up
1011/1018 - syslog service listening on the various TCP/UDP IP addresses

shuth

Also if the event has occurred outside your time frame defined under the "past polling intervals to search for events", the testing won't detect the event.

So if your polling frequency is 300 seconds (5 minutes), the monitor will only match events that occurred in the last 450 seconds (7.5 minutes).

dkohler

I have a powershell script to inject the event into the log for testing purposes.

dkohler

Everything matches. Log name, event ID, everything. I even changed the Event Type from 'Any event' to 'information', with no luck. My monitor is configured the same as yours, for my event log.

I even changed the monitor to look at the Application log, and Keyword matching does not work there either.

christopher.t.jones123

Have you turned on debug logging for the application monitor to see if the log will provide you more information as to why it isn't working?

Success Center- Turn on Application debugging for SAM

dkohler

sturdyerde

christopher.t.jones123 wrote:
Have you turned on debug logging for the application monitor to see if the log will provide you more information as to why it isn't working?
Success Center- Turn on Application debugging for SAM

#CorrectAnswer #ProTip #mvp #Thanks, I'm going to use this myself now!