Monitoring a service or log in NT or 2000

[Dave Foster_4]

Is it possible to monitor when a service fails on an NT or 2000 box from Insight Manager 7. Also, can you monitor errors in the System or Application Event log from within Insight Manager?

thx in advance

Dave F

[Brent Ingler · Accepted solution]

You can set up process monitor traps on individual machines, which will send an SNMP trap to the CIM server whenever a service stops/starts. You can then set up a query to identify those, and a notification task based on that query if you so desire. As far as monitoring the NT event logs, I don't believe that there is a way to do this, natively, in CIM. If you find a way, though, please post it here.

Brent

[Dave Foster_4]

Thanks Brent for the response. The process monitor makes perfect sense. I'm a little unsure how you identify the trap in the query. I know you can do a query by Event type and then backup (but I don't see anything about the process I'm trying to monitor). For example, say I want to monitor whether the Open File Agent is loaded "ofmnt.exe" how do I know what the trap is? In TNG you have a console and can physically see the trap message from there you make message records and actions. Any help would be greatfully appreciated.

thx

Dave

[Brent Ingler]

Once you enable the process monitor trap, it will start sending traps to the CIM console. You can then define the event query, for example to look at the following:

Events by cleared status: Not cleared
Events of Type: Process Monitor Event (found under application)

If you want to get more granular, say set up a specific notification for each different process you're monitoring, you can further narrow down the query criteria by adding "Devices by name" and then selecting the appropriate server. Once you've done all the queries that you want to use, you then create a notification task, and point it to the applicable query.

Brent

[Brent Ingler]

Dave,

One other thing that I've found:

Keep in mind, I just found this today, so all my facts might not be straight. This is preliminary, and should be taken as such.

In Win2k, there's a utility, evntwin, which will supposedly allow you to send specific event log events as SNMP traps. You need to have Win2k SP3 for this to work well, though. Unfortunately, with SP3 loaded on a test machine I have, I still haven't been able to send these traps to CIM. I'm going to post this as a new thread, but I wanted to let you know that this possibility is out there, since you had asked about it. I'll let you know if I figure it out and I'd appreciate it if you'd do the same.

Brent

[Dave Foster_4]

Thanks Brent,

I'll try what you've mentioned and let you know how it turns out. Let's hope I can put TNG behind me :-) Long live CIM :-)

Dave

[Dave Foster_4]

HI Brent,

I'm still working on this but I thought I'd let you know that both the Event log trap (through evntwin) and Process trap (through Process Montitor) are both working from a 2000 workstation running sp3. thx for the help