What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general.

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags


View all Tags

Please help me explain Eventlog sensor

Votes:

0

Hi, I'm trying to set up an Eventlog sensor that should change state to error when an Error event is logged in the Application log. But I dont understand how the sensor works.

1) The sensor never goes into error state even though an event is clearly logged. I have tried with several settings of Limit values eg.: 0,0001. The New Records graph turns red, but the sensor is still Ok?

2) Now, if I can get the sensor to work, how is the error state cleared? How does the event log sensor know when I have fixed an error condition on the server? As far as I know, it just can't. And there is no "reset" button on the sensor.

3) Why are PRTG monitoring the eventlog as #/sec? It sounds like an insanely precise scale. Often you only see e.g. an error condition or another application error occur randomly, maybe once per week (hopefully very seldom, actually). That's 0,00000165343915 errors/sec????

I have tried reading the documentation over and over and looked at other articles in the KB but to no avail. I think that I simply don't understand that sensor. (We have more than 1.300 sensors so I'm not THAT new to PRTG :) )

error-state event-log rate

Created on Aug 7, 2015 12:53:08 PM



2 Replies

Votes:

0

Hi PDC,

you are right, WMI Eventlog Sensor is a bit tricky. Did you make sure that you put 0,0001 into "Upper Error Limit" as described here: https://kb.paessler.com/en/topic/59803-my-event-log-sensor-ignores-changes-in-the-event-log-what-can-i-do

I just tested it myself using current stable version (15.3.18.3334) and the whole sensor goes into error state (not just the channel #/s turning red), although it takes a few seconds for the sensor to change its state.

There is however one little detail (or backdraw if you will) that is also explained in the aforementioned KB post: "This status will persist one scanning interval. If the filter does not match in the following scanning interval, the sensor will switch to status Up again."

You may want to consider setting up notifications additionally in this case using a State Trigger to not miss an occurred event matching your desired criteria.

Regards, Erhard

Created on Aug 11, 2015 8:39:08 AM by Erhard Mikulik [Paessler Support]

Last change on Aug 11, 2015 8:40:25 AM by Erhard Mikulik [Paessler Support]



Votes:

0

Hi Erhard,

Thank you for the explanation. Yes, I think notification is the way to ensure that we get - well - notified. As you say: the status will persist on scanning interval - so chances are that we won't see it changing its state if we test every e.g. 5 min. After having the sensor set up for a few days, I noticed the sensor going into Bad state a couple of times, so apparently, I wasnt' patient enough :)

Br,

Bjorn

Created on Aug 13, 2015 8:18:56 AM




Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.