Pages: [1]   Go Down
Author Topic: [Solved] Windows Eventlog Monitoring problem  (Read 564 times)
0 Members and 2 Guests are viewing this topic.
JeeSee
Full Member
***

Karma: 0
Offline Offline

Posts: 29



View Profile WWW
« on: November 12, 2009, 02:07:06 PM »

Pandora FMS version: 2.1 Windows Agent 2.1

In the Windows Agent pandora_agent.conf I've added the following lines to monitor the Windows System Eventlog and Application Eventlog for Error or Warnings:

Code:
#Windows System Eventlog Error Messages monitoring
module_begin
module_name log_system_err
module_type generic_data_string
module_description System errors
module_logevent
module_source System
module_eventtype error
module_end

#Windows System Eventlog Warning Messages monitoring
module_begin
module_name log_system_wrn
module_type generic_data_string
module_description System warnings
module_logevent
module_source System
module_eventtype warning
module_end

#Windows Application Eventlog Error Messages monitoring
module_begin
module_name log_app_err
module_type generic_data_string
module_description Application errors
module_logevent
module_source Application
module_eventtype error
module_end

#Windows Application Eventlog Warning Messages monitoring
module_begin
module_name log_app_wrn
module_type generic_data_string
module_description Application warnings
module_logevent
module_source Application
module_eventtype warning
module_end

After that I restarted the Pandora Agent service and deleted the Agent in the Pandora FMS Webconsole. After a little time the Agent is found by Pandora FMS Webconsole, including some modules I configured in the pandora_agent.conf file, but the logevent modules aren't shown. When I send a testevent to the machine, to log an ERROR-event, it is shown in the application Eventlog on the Windows system, but not in Pandora FMS Console.
What's wrong with the above configuration?
We only need to monitor Errors/Warning from the Eventlogs from our Windows Agents.

Any help would be welcome
« Last Edit: November 17, 2009, 03:27:50 PM by raul » Logged

JeeSee
Full Member
***

Karma: 0
Offline Offline

Posts: 29



View Profile WWW
« Reply #1 on: November 17, 2009, 02:59:01 PM »

Eventlog module is initialized after an Event occurs. When there are no events, the module stays uninitialized till there's an Event.
Logged

Sancho Lerena
Administrator
Expert member
*****

Karma: 24
Offline Offline

Posts: 1151


I can see everything... with my glasses :-)


View Profile WWW
« Reply #2 on: November 22, 2009, 09:25:44 PM »

Eventlog module is initialized after an Event occurs. When there are no events, the module stays uninitialized till there's an Event.

Exactly, that's the standard behaviour.
Logged

-- See you in the other screen.

atheo
Newbie
*

Karma: 0
Offline Offline

Posts: 3


View Profile
« Reply #3 on: November 15, 2011, 03:17:37 PM »

I add the same code as below and only application is working .. the system is not initialized module:

#Windows System Eventlog Error Messages monitoring
module_begin
module_name log_system_err
module_type generic_data_string
module_description System errors
module_logevent
module_source System
module_eventtype error
module_end

#Windows System Eventlog Warning Messages monitoring
module_begin
module_name log_system_wrn
module_type generic_data_string
module_description System warnings
module_logevent
module_source System
module_eventtype warning
module_end

#Windows Application Eventlog Error Messages monitoring
module_begin
module_name log_app_err
module_type generic_data_string
module_description Application errors
module_logevent
module_source Application
module_eventtype error
module_end

#Windows Application Eventlog Warning Messages monitoring
module_begin
module_name log_app_wrn
module_type generic_data_string
module_description Application warnings
module_logevent
module_source Application
module_eventtype warning
module_end
Logged

atheo
Newbie
*

Karma: 0
Offline Offline

Posts: 3


View Profile
« Reply #4 on: November 16, 2011, 03:28:58 PM »

Btw did you ever tried to receive alerts ie email for this modules ?
Logged

Pages: [1]   Go Up
Print
 
Jump to:  


SourceForge.net Logo  This site is monitored by Pandora FMS   ArticaST