MonitorWare Knowledge Base

If EventReporter is setup to write Windows Event logs to a database ("Write to Database") and the connection to the database drops, or EventReporter fails to connect to the database, what happens to the Windows Event logs that occur during the failure? Is EventReporter "smart" enough to continue logging the events where the failure occurred once the connection is re-established?

How about if the database is down for several hours or days? When the database finally comes back online, will EventReporter be able to write all the Windows Event messages that occurred while the database was down?

Thanks,
ckflentje

Hi ckflentje,

the EventLog Monitor is a serialized service inside EventReporter which means it will only continue to process Events if the Actions (Like Database Logging) were successful. In case of a failure, EventReporter will log an error event with ID 114 into the application EventLog. EventReporter will retry to process the same Evenet during it's next iteration and once the Database Logging recovers, it will report another event with ID 114 and continue it's work.

--
I hope this helps - best regards,
Andre Lorbach

That was a quick response - thanks! We own an old version of EventReporter and are looking to use the latest version for a new project but wanted to be sure of its "recoverability" before we upgraded. As long as we can ensure EventReporter can recover up to a days worth or more of Window Events that didn't get logged (due to db failure/down time) we'll probably proceed forward with the project.

Thanks again,
ckflentje

The only thing that can happen is, that the EventLog runs full after some time, and older events get overwritten. But you will find some advanced options on the "Advanced EventLog handling" tab (configureable for each EventLog Channel) for even for those conditions.

I recommend to download the latest trial version of EventReporter, and perform some tests. If you need more trialtime, just drop a little email to support@adiscon.com, and we will see what we can do .

--
best regards,
Andre Lorbach