MonitorWare Knowledge Base

Hi

Following question:

When i write into Windows Event Log (application), and i have a lot entries, i do not have a fast overview of what happens, because the source is always "AdisconMonitorWareAgent".

So, is it possible to replace in the event viewer, when the action is "write to Event log" the source "AdisconMonitorWareAgent" with a configurable text??

Kind regards

Hi,

you can enable the "Replace Event Log Source" option, this will replace the EventSource "AdisconMonitorWareAgent" with Source of the message. This can be a IP Address / Hostname or the computer name, it depends from what is written into the Eventlog

regards,
Andre

Hi

Yes i have tested this option, but instead of AdisconMonitorWareAgent i have I36369, or 10.10.10.10 but always the same entry.



So this does not help.

Kind regards

Could you elaborate a little more on what you are trying to do? I have to admit that I do not fully understand it. An example would be most helpful.

Best regards,
Rainer Gerhards
Adiscon

Hello,

as said in off-form communication, the request actually needed a new feature. This is now implemented. The new version can be found at

www.adiscon.org/download/MWareMax21sp1.exe

I'd appreciate if you let us know if this is what you need

Thanks,
Rainer

Hi

I have tested and following happens:

I activate "Replace Event Log Source", i put my own text like "LPM - Event", this works, but also the category is changed from none to (3) and the Event ID is 16 ?? and not 10001 and the Message to log is as follow: Die Beschreibung der Ereigniskennung ( 16 ) in ( LPM - Event 0 ) wurde nicht gefunden......
and should only be :
Der Computer CI-ROB: TSS CITRIX - zuviele gleichzeitige Anmeldungen.

So we would only replace the Event Log Source.

Kind regards

Dear Bertolino,

the issue with the EventID and Category is currently being analyzed. We will post an update when we know more about this.

The text you see in EventViewer, however, is caused by replacing the event source. As we discussed, this text always appears when a non-registered source is used. This is by design of the Windows event log API. If you would like to avoid this text, you MUST use "AdisconMonitoreWareAgent" as the source AND the event id must be between 10,000 and 10,100. MonitorWare Agent provides the necessary message library for these IDs. However, if you replace the source, no message library can be provided and hence the message you see appears. There is no way to work around this (well... you could actually register those sources of yours to the mwagent.exe and use the above-mentioned event IDs ... but that's a little crumbersome and doesn't "feel" really like the right thing to me...).

Rainer

I just forgot one link. Please see

http://www.mwagent.com/en/Manual/beta/e ... ptions.htm

This contains the description of the message library problem.

Rainer

Hi


"the issue with the EventID and Category is currently being analyzed. We will post an update when we know more about this."

Do you have any news ?.

Kind regards

Hi,

sorry - it actually has been fixed in the SP1 version, but somehow the rolling beta was not updated. This is done now, so I hope it will become available today.

I keep you posted (- this time actually ).

Rainer

Hi,

the new RB Setup has been updated including the Event ID & Category bugfix:

http://forum.adiscon.com/topic,684.html

best regards,
Andre Lorbach