MonitorWare Knowledge Base

HI

I have noticed that after a unexpected reboot, MonitorWare sometimes does not continue on the last record. All entries are processed.

Is there any possibility to avoid this ??

Kind regards

Hello,

Many thanks for contacting Adiscon Support and for using our products. Our MonitorWare Line of Products e.g. EventReporter, MonitorWare Agent etc. periodically reads the Windows Event Log. While reading the Windows Event Log, they try to read the last record that was processed in the last run. So they don't send the previous logs when the service is restarted or even when the system is re-booted.

Would you please check your Windows Event Log for any occurance of Event ID 1011?

If you see an occurance of Event ID 1011 then the reason is explained in the upcoming lines. While reading the Windows Event Log, MonitorWare Line of Products i.e. EventReporter (in your case) try to read the last record that was processed in the last run. We had opt for this, because if the last record doesn't exist, then either someone had messed up with the Windows Event Log or the Windows Event Log was truncated. When MonitorWare Line of Products can not read the last record, then two things happen:

1. MonitorWare Line of Products send an Event ID 1011 to the Application Event Log stating that the Log has been truncated (this can be disabled by unchecking the "Report Log Truncation" checkbox in the configuration program). It will stop the Event ID 1011 from being reported. And this resuts in re-sending the previous logs.
2. MonitorWare Line of Products re-set the counter to the begining of the Windows Event Log.

Number 2 is done because there is no better way to resume processing, especially when the last record could not be found (it would be guessing where to begin). Please note that this can lead to message duplication.

This condition is normal when someone has cleared the event log in question. However, if that is not the case, seeing an 1011 event is a good indication that somebody has messed up with the event logs.

The following Step-by-step might be helpful for you.

- Reporing Log Truncation
http://www.eventreporter.com/Common/en/ ... cation.asp

We have a "Do not Process Existing Entries" in MonitorWare Agent's Event Log Monitor Service. This option is also available in the EventReport 6.3 SP1.

- Event Log Monitor
http://www.mwagent.com/en/Manual/curren ... nitor1.htm

Would you please look into the above URL and browse to the section that says "Do not Process Existing Entries".

I hope that this helps. If you have further queries don't hesitate to contact us.

Regards,
Tamsila Siddique.
Adiscon

Hi

I know these parameters, but this is not the problem.


Today we had two servers with exactly the same problem:

After a unexpected reboot, MonitorWAreAgent has the following problem:

I think it does not find the lastrecord or because of the unexpected reboot there is any problem with this lastrecord, because Monitorware processes all entries again.

And that is a big problem.

On these servers: until today i had about 40 "Fire" and today after this unexpected error i had these 40 "fire" again but within a few minutes.

Kind regards

Hi,

we have tested such scenarios before and couldn't reproduce them.
The rerun on the Eventlog seems to be caused by corruption of the Eventlog in your case.

At the moment, the whole Eventlog is reprocessed as we can't know what has been processed till yet and what has not.
I of course understand that you get numerous false "fire" events in this case.

We currently think about an option to prevent the reprocessing of the whole Eventlog in such special cases by settings an additional advanced option. Anyway note that in this case, you wouldn't get events generated from the unexpected crash till after the reboot.

regards,
Andre

Hi

Also today we had the same problem, one sever had hardware problems => unexpected reboot => all entries in the eventlog system where processed !

So it would be great if we there were 2 buttons:

1. do not process existing entries the first time the service is started
2. do not process existing entries every time the serive is started.

Actually we use Version 236 ( I know it is RB) but we use some feature.

I would appriciate when changes made are in the RB.

Kind regards

Hi,

Beta 237 is out already with some intersting fixes
Anyway we are currently adding an option to prevent reprocessing of the whole Eventlog if the log were trunscated (for what reason ever).

So let me complete the list
1. Do not process existing entries the first time the service is started
Already present, configureable on Eventlogtype basis.
2. Do not process existing entries every time the service is started.
Will be added as advanced option (In RB as well)
3. Do not process existing entries if the eventlog were trunscated
Will be added as advanced option (In RB as well)

regards,
Andre

Hi

Yes that's great. So i'am waiting for RB 238

Kind regards

Hi,

fyi, the RB Setup has been updated to RB238 and nwo contains these 2 new options
http://forum.adiscon.com/topic,684.html

regards,
Andre