MonitorWare Knowledge Base

Hi, I'm trying out the eventreporter software. I have 200+ NT 4.0 servers that have a ton of events in all 3 event logs. I want to set up eventreporter to ignore those events, and only forward new events.

I plan on deploying this via the engine-only install, so I won't know what record number each event log is at. Can a flag be set to forward only new events? Also, I don't want to purge the event logs.

-Tony

Hi,

Eventreporter send the whole eventlog only the first time you start it.
It has its own counter, which is then used to only forward new event.

If you don't want to forward the old events at first time, just use an invalid syslog server (like 127.0.0.1) and change it to your real syslog server after EventReporter has finished forwarding all events.

How can you tell when it has completed sending all of the pre-existing events?

thoyt,

EventReporter has now the option "Do NOT process existing entries on Service Startup" which prevents from processing of the whole Windows event log when the service starts the first time.

You can find this feature in the "Advanced Options" of Event Log Monitor service.
http://www.eventreporter.com/en/Manual/ ... nitor1.htm

Hope this is what you are looking for.

Best regards,
Michael Meckelein
Adiscon