HP SIM and event log monitoring?

[davep1_1]

Hi,

I currently run SIM in my company monitoring our Proliant hardware, what I'm wondering if I can extend this monitoring to include Windows Event logs.

I understand I may be able to achieve this by setting up SNMP traps and importing appropriate MIBs into SIM, but I haven't been able to find any useful MIBS on the net which allow SIM to understand the Windows SNMP traps, and I'd rather not write my own MIBs.

The second idea I had was using WMI to get the events, but I haven't been able to find any information on if this is possible with SIM.

So, is this possible? Or am I going about this all the wrong way? Should I be using a different product to SIM?
I'd appreciate some input. :)

Cheers.

[V Deepak Kumar]

a) With Windows events log do you mean the logs that i can see via Computer Management -> System Tools -> Event Viewer . Under Event Viewer we have Application, Security, System.
b) What do you mean by monitoring the logs, Do you mean that you want to see the above logs via SIM?
Thanks
Deepak

[davep1_1]

Thanks for your response,

Yes, I do mean the logs in the event viewer.

And yes, I would like to see those events via the SIM interface. (Not necessarily all of them, but ideally all of the important ones).

The aim being to have SIM send email alerts whenever it sees a Windows error on any of our servers.

[davep1_1]

Does noone have any ideas? Surely I can't be the only one who wishes to monitor the event logs of my servers.

[David Claypool]

In the past, Microsoft has provided the utilities EVNTWIN and EVNTCMD that generated an SNMP trap for selected Windows events as they occurred. I haven't checked Longhorn, but it isn't present on Vista.

The biggest problem is that Microsoft never published a MIB (that I've ever been able to find) that matches up with the generated events, so they all will appear in HP SIM as generic unregistered.

[davep1_1]

I've played with evntwin and have been able to use it to send SNMP traps of the events, but as you say, the biggest problem is that Microsoft haven't provided any MIBs.

I know there are a few custom MIBs available but in testing I haven't been able to use them effectively.

Assuming that SIM can't achieve what I'm after, does anyone know of any other products that will?

[Igor Karasik]

>>Assuming that SIM can't achieve what I'm after, does anyone know of any other products that will?


We use MOM - now System center operations manager:
http://www.microsoft.com/systemcenter/opsmgr/default.mspx
and HP management packs for MOM:
http://www.microsoft.com/technet/prodtechnol/scp/catalog.aspx?Vendor=HP


And I recenlty read about free tool:
http://4sysops.com/archives/eventsentry-light-centralized-real-time-event-log-monitoring/

[Rancher]

You might try this and you can at least get service alerts. It has been a long time since I have used it though.
On the server, go to Control Panel, HP Management Agents. Go to Process MOnitor, and select the ones you want to monitor and if you want start and/ or stop alerts.

[garyfowkes]

We also monitor HP Blade servers with SIM, primarily running ESX server. We also have a couple of proliant Windows 2003 servers, and we're trying to achieve the same level of monitoring for windoze events. Evntwin works fine, and snmp traps come through to SIM as "unregistered". We tried to compile a sample mib (attached) but mcompile complains about the svcCtlMgr OBJECT IDENTIFIER - maximun number of subids is 16
Mib compilation failed.

Can anybody help??

[steve83]

Anyone have a known working solution for Windows event log to HP SIM?