Monitoring windows event logs

[johnp_hyperic]

Hi All,

I am currently testing Hyperic, ultimatly I want to use it to monitor my customers WIndows servers as part of a managed services arrangement. To do this I need to be able to monitor at minimum:

* Disk free space
* Windows event logs in the System and Application logs (alert for warnings, notify for errors)
* Available WIndows updates
* Anti-Virus update status (I think the best way to do this is via WMI to the Windows Security Centre).

I have most of the above working (I havent started on the WMI stuff yet), but I'm struggling with the event logs. I have attached a screen capture of the platform configuration. It seems to be working to some extent, but I am only seeing info events, not info, warning and error as the confgiuration would imply (I assume the order is, from lowest to highest, info, warning, error).

I would appreceate assistance with this. I think Hyperic is an excellent product that will meet my needs, but I just need to overcome these issues with the event log.

[admin]

We have a excellent documentation on Event Manager.

http://support.hyperic.com/display/DOC/ui-Inventory.Configuration#ui-Inventory.Configuration-track

Please let me know if you still have any questions.

Thank you,
Nipuna

[johnp_hyperic]

I'm still having trouble getting this to work. What I want to do is track the Windows System and Application logs, generating alerts for Warnings and Errors. I am getting alerts, but they look like this:

../../bundles/agent-4.0.1-905/pdk/scripts/windows_updates.vbs: Timeout running [c:\winnt\system32\cscript.exe //nologo ../../bundles/agent-4.0.1-905/pdk/scripts/windows_updates.vbs ]

What I really need to the Event ID and description text.

[johnp_hyperic]

Read doco but still having problems

[johnp_hyperic]

I think I have a solution. It would appear that the event log names in the Platform Configuration need to be specified in a case sensitive manner. The application log needs to be specified all upper case (APPLICATION) while system needs to be specified in lower case (system). This matches the case found in the event center.

I suspect this is a bug in Hyperic causing this issue.

[cnmmbd]

I got the same problem. And johnp's solution is useful.
I foudn that some system logs were logged as SYSTEM, but not the lower case (system).
I had to set the platform.log_track.eventlogs to * to track all logs.