Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Custom Event Log Monitoring

Good Morning,

I am at task to make Orion APM monitor failed logins in our AD environment. I have created an alert against all our AD servers and some show up as "Up" others show up as "Down". This is because event ID 675 does not exist during the polling interval (correct me if I am wrong).

The one that contains an event 675 we used to test our thresholds for statistic waring and statistic critical.

Is there a way to utilize the statistic thresholds only. This tosses people into a frenzy if they see something in red and I would like it green all the time unless a statistic threshold is met.

Just a side note, when I test each individual node, the nodes with no failed login attempts returns "failed with 'NotAvailable' status". As stated above, I want all nodes to remain green until a threshold is met?

Find more posts tagged with

Accepted answers

jiri.tomek

Hello,
unfortunately, Windows Event Log monitor changes status if it finds at least one occurrence of the event. You can't tell it to go down if it finds for example "at least 10 events" since last poll.

Statistic threshold can be used to report number of events in general, but in your case you would have to set monitor to be down by default and only if it finds specified event then it goes up. Then you can use thresholds to have Warning and Critical states. I know that this doesn't make sense because monitor would be down if no failed login attempt occurs.

To accomplish your task you would have to write custom VB script that would return number of failed login attempts. Then you can use thresholds as you want.

All comments

qle

You should be able to update the script so that the proper exit code is reported. As per the APM admin guide, you'd simply set the exit code to 0 (Up). I'm not sure what statistic you would measure to change the status to warning or critical though.

m698322h

We have orion version 9.5.1 and did a "Create New Template" under the Application Monitor Templates tab.

From here we went to Add a Component Monitor, Selected All Component Monitors, then checked Windows Event Log Monitor.

We then gave it a custom name, told it to monitor the Security logs, and watch for event ID 675 - Failed login attempt (I think this is it without looking)

At the bottom one can set Critical and Warning thresholds (how many times does this show up since last poll).

Any help appreciated, we did not have to create a script at all!

qle

Which version of APM are you running? I must be using an older version because I don't have that component monitor available to me.

m698322h

We are using the latest version 3.1 which was released at the end of December. This is one of the additions they added. It is confusing that they would consider the node "down" if one failed attempt is found within the last poll where I am utilizing it for intrusion attempts on servers.

jiri.tomek

To accomplish your task you would have to write custom VB script that would return number of failed login attempts. Then you can use thresholds as you want.