Event Log Sensor Don't Work

Have you double checked that the log file that is set in the sensor and in the event type field that you specified the correct type?

Also, these sensors are somewhat different in that when there is an event, the New Records /s can be very low. Since this is a division of the amount of events by the seconds in the scanning interval, you will sometimes see values of <.001. If you want to test this easier and see if the sensor is in fact picking these up but is showing a low value, you can do this by running the command below.

eventcreate /ID 1 /L APPLICATION /T INFORMATION /SO MYEVENTSOURCE /D "My first log"

This will create a new event source named "MYEVENTSOURCE" under APPLICATION event log as INFORMATION event type for example.

Thnx for your reply Greg.

Mybe this is a stupid question but where do I need to run this Command?

I have made both Events on one server. The only thing I change:

type --> Error Source --> Backup

But when I only change the type to error it will show me the "OK" status. When I disable the type, It gives me the last event in the eventlog.

Greeting Michaël.

The command should be run on the server that is being monitored for those events. The sensor will always show an OK status unless you specify in the sensor itself that you want it to have an error limit on the new records channel.

This sensor is not designed to go into an error state when it detects one of these events. You have to define the channel limits to trigger an error state when the value goes above 0 to have the sensor change status when there is an event and you will likely need to have this value set to less than 1 as noted in the previous post.