MonitorWare Knowledge Base

Hi, there,

Can I use EventReporter to forward the NetApp Event Log to a syslog server?

If yes, how can I do that?

Thanks,
Jeff

Hi Jeff,

yes, this is possible, and a description is available here:

http://www.eventreporter.com/common/en/ ... syslog.php

Rainer

I have read it, but after I enable remote EventLog monitoring, and enter the NetApp filer's IP address, click the Verify, I get following message:

Error while verifying remote EventLog access

Error number:0

Any idea?

Thanks
Jeff

Ah, I see. The article fails to explain the permissions issue. Please see here:

http://www.eventreporter.com/common/en/ ... errors.php

Please let us know if that solves the issue.

Thanks,
Rainer

Changed the service to log on as Domain administrator, but still get the same error.

Thanks,
Jeff

I enable the debug log, it is said that:

| Error | CLibCacheListEntry|GetAndSetLibrary: Failed to load library "\\10.128.13.23\C$\etc\system32\MsObjs.dll"- GetLastError: 2

It is NetApp filer, not a windows server, just copy the MsObjs.dll from windows server to the folder?

Thanks,
Jeff

Hi,

please enable the option "Read EventLog Sources from local machine" in your EventLog Monitor settings, then EventReporter will use the local dll's (if available).

best regards,
Andre Lorbach

After selected "Read EventLog Sources from local machine", the verify still failed.

Although verify failed, I can forward the event log from NetApp filer to syslog server.

I still have one problem, the date field in the syslog seems not correct, not the original date of the event.

Hi,

you can ignore the verify function in this case.
If you mean the date in the Syslog header of the message, this will be the current time by default.
You may either include the %timegenerated% property in the forwarded EventLog Message, or use a custom Syslog header like this:


RFC 5424 Sample:

Code: Select all

<%syslogprifac%>%syslogver% %timegenerated:::date-rfc3339% %source% %syslogappname% %syslogprocid% %syslogmsgid% %syslogstructdata%

best regards,
Andre Lorbach

Hi,

It works. Thanks.

But sometimes evntslog.exe caused CPU usage at 100%. Any idea?

Best Regards,
Jeff

Possible while processing the Events. Have you lowered the overrun protection time to 0 milliseconds?

best regards,
Andre Lorbach

Please let me also add that by default EventReporter runs with low priority, so it will yield CPU immediately if some other process needs it.

What I mean should be:

After running a few while, evntslog.exe causes CPU running at 100% until it be stopped.

Jeff

Which Version of EventReporter are you using, and are there any error events from EventReporter in the application EventLog?

EventReporter 11.0.328

Now when I stop the service, and restart it, the CPU will go to 100% quickly.

Nothing error in the Event Log.