Monday, December 8, 2014

Correlated Missing Event Detection

Since it is not possible to drop more than 2 images into a forum reply I use my blog to provide the screenshot for a question there.

The original thread can be found here.

Under Authoring, Monitor, create a new unit monitor. Choose Correlated Missing Event Detection:

clip_image002

Enter a proper name and description and choose your target (Windows Computer would be all):

clip_image004

Select the event log for the event that resets your monitor back to healthy (if you’ve chosen event reset above):

clip_image006

Enter the event ID and the source. I took the single occurring of event ID 2 as a reset as a sample:

clip_image008

Choose the event log where the first event is logged:

clip_image010

Enter the event ID for the first event you’re expecting:

clip_image012

Choose the event log for the second event:

clip_image014

Enter the event ID for the second event you’re expecting:

clip_image016

Choose the correlation mode, here B must follow A within 60sec:

clip_image018

Select the missing event as warning and in the other as healthy (could be timer reset either):

clip_image020

Configure the alert settings as you’d like to see the alert in the alert views:

clip_image022

Cheers,
Patrick

All information is provided "as is" without any warranty! Try in lab before. Handle with care in production.

0 Comments:

Post a Comment