Windows Event Log and Keyword matching

Hey all,

I've got an APM monitor configured to watch for a very specific event log message. I've got it pinned down with:

Log Source
Event ID
Event Type
Keywords

I'm filtering on "Keywords" with "[Microsoft][SQL Native Client]Communication link failure". Unfortunately this matches _every_ event log message with the same "Log Source", "Event ID", and "Event Type", regardless of the content of the message.

In other words, it matches event text with "[Microsoft][SQL Native Client]Communication link failure" in it, but it's also matching events where that phrase is absent. For what it's worth, I've also tried the same thing using a Regular Expression match with the same (wrong)results.

Anybody seen this kind of behavior before? Is there something else needed to enforce keyword matching?

For whatever it's worth we're running:

SolarWinds Orion Core 2011.1.2, APM 4.2.0, NPM 10.1.3, IVIM 1.1.2

Thanks!

Find more posts tagged with

application_performance_monitor

event_log

windows_event

Accepted answers

lukas.belza

Hello,

to close the loop on this one: We have found that there is issue in the Windows Event Log monitor - if the multiline textbox with keywords contains new line character at the end, this new line character is used as new keyword for matching. So all events containing new line character cause that the monitor goes to Down state.

Removing empty lines from keywords textbox resolved the issue.

Thanks,

Lukas

All comments

DONDERKA

Hi dewach

can you post here screenshot with Windows Event Log monitor settings? Or post precise format of the keywords string.

The keywords could be filled with single sentence or list of words or phrases. In following format:

"keyword1", "keyword2", "phrase number one"

Messages in Events which are found by Log Source, Event Type and Event Id are scanned for those keywords. Note that the only one of the keyword must be found in the message to mark this event as positive match.

dewach

Here's the definition:

I've also tried a number of other iterations, like just "Communication link failure", with the same result.

Thanks!

martin.susil

Could you please also post screenshot from Windows Event Log so we could see how exactly the log message looks?

Thank you

dewach

Here's the "correct" event log (we're matching successfully):

The issue is that we're _also_ matching messages like this:

Thanks!

randallzapata

Did you figure this out...I want to do the same thing?

danielleh

Hi randallzapata--

Did you try Lukas.Belza's instructions?