<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma",sans-serif;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma",sans-serif;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Perfect, thank you! That worked. I’ve been testing with creating my own event log entries to trigger the msgs to go red.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Offhand, do you know how long until it goes green again, is it an hour or so?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Brandon Dale [mailto:BDale@kitchengroup.com.au]
<br>
<b>Sent:</b> Thursday, June 04, 2015 7:42 PM<br>
<b>To:</b> Blumenthal, Russell; xymon@xymon.com<br>
<b>Subject:</b> RE: [Xymon] windows event log<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-AU" style="color:#1F497D">I haven’t tested this but in your analysis.cfg it should be something like this:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="color:#1F497D">HOST=servername<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="color:#1F497D">LOG %.* %\[1\]\s-\sTest\sEvent COLOR=red<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="color:#1F497D">This should go red for anything that contains “<b>[1] – Test Event”
</b>(where “[1]” is the eventid and “Test Event” is the source name)<b> </b>in any event log. In your client-local.cfg you need to make sure you are also collecting the eventlogs where you expect to see this event.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-AU" style="color:#1F497D">Regards, <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-AU" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-AU" style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:#000097">Brandon
</span></b><span lang="EN-AU" style="color:#1F497D"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-AU" style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif"> Xymon [<a href="mailto:xymon-bounces@xymon.com">mailto:xymon-bounces@xymon.com</a>]
<b>On Behalf Of </b>Blumenthal, Russell<br>
<b>Sent:</b> Friday, 5 June 2015 4:10 AM<br>
<b>To:</b> <a href="mailto:xymon@xymon.com">xymon@xymon.com</a><br>
<b>Subject:</b> [Xymon] windows event log<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-AU"><o:p> </o:p></span></p>
<p class="MsoNormal">Hey folks,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Having a major brain fart right now. How would I get Xymon to go red when a specific event ID on a Windows servers is detected in the event log? I am using the PowerShell client so the VM is in a central mode. I have played around in analysis.cfg
and client-local.cfg but haven’t been able to get it down to a specific ID.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><br>
<br>
This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient,
please contact the sender by e-mail and destroy all copies of the original. <o:p>
</o:p></span></p>
</div>
</body>
</html>