MonitorWare Knowledge Base

Hi, it's me again

So following situation:

We have written ADM Files to manage Monitorware Agent, so we can Disable and Enable "runnings Services" (MWA), change some Filterparameters etc.

Now the servers are in one OU with different GPO's, and i would like to exclude 1 or more specific server, even when this "running service" is enabled.

So when i want to add a filter => Event Log Monitor => the "Event Cumputer" is missing (i think it is by design).

The problem is that Datacollectors from e Citrixfarm have a lot of one event (logon/logoff,528) even when no user is connected. So we would like to exclude these servers without creating their own OU in the ADS.

Any idea ?

If I understood you correctly, you are looking for the "source" property. Please see:

http://www.mwagent.com/en/Manual/curren ... erties.htm

Please let me know if that solved your problem.

Best regards,
Rainer Gerhards
Adiscon

Hi

I don't understandd, but perhaps I explain in a other way.

When you open the Event Viewer in W2K, then choose System.

So you see columns beginning with "Type2 and ending with "Computer", and this "Computer" i need. So i could add in the filterconditions NOT= computer, equal = Computer Netbiosname

?

Kind regards

Sorry for not being precise enough. The computer name is stored in the "source" property. So you do not

"filterconditions NOT= computer, equal = Computer Netbiosname "

but

"filterconditions NOT= source, equal = Computer Netbiosname"

Does this clarify?

Rainer

HI

So it works, the only problem is, that it is case sensitive, therefore it does not work before.

Thank you.

Kind regards

Hi

Back to my problem:

It is really case sensitive, and i have seen in the event viewer, that sometimes the "computer" is i33333 or sometimes I44444, so i cannot do this centrally, because i don't know, if it is "i" or "I" on a particullar server.

Any idea to eleminate case sensitivity?

Kind regards

You can use the property replacer to ensure a consistent case. This is done by specifying %source:::uppercase%. With this, the computer name is first converted to upper case (you could also use %source:::lowercase% if you prefer it that way).

Details on the property replacer are available at:

http://www.mwagent.com/en/Manual/curren ... erties.htm

While writing this, I notice that the filter does not work with the full property replacer. Please let me check. I'll keep you updated...

Rainer

OK, the property replacer is now supported in the upcoming SP1 version of MonitorWare Agent. It can be downloaded here:

http://www.adiscon.org/download/MWareMax21sp1.exe

Please note that only the "Custom Property" filter supports the property replacer (because the property name can not be modified in any others).

Looking forward to your feedback,
Rainer

Hi

Yes it works now and it is exactly what we need.

Thanks and kind regards.