Hi, I'm trying to set up an Eventlog sensor that should change state to error when an Error event is logged in the Application log. But I dont understand how the sensor works.
1) The sensor never goes into error state even though an event is clearly logged. I have tried with several settings of Limit values eg.: 0,0001. The New Records graph turns red, but the sensor is still Ok?
2) Now, if I can get the sensor to work, how is the error state cleared? How does the event log sensor know when I have fixed an error condition on the server? As far as I know, it just can't. And there is no "reset" button on the sensor.
3) Why are PRTG monitoring the eventlog as #/sec? It sounds like an insanely precise scale. Often you only see e.g. an error condition or another application error occur randomly, maybe once per week (hopefully very seldom, actually). That's 0,00000165343915 errors/sec????
I have tried reading the documentation over and over and looked at other articles in the KB but to no avail. I think that I simply don't understand that sensor. (We have more than 1.300 sensors so I'm not THAT new to PRTG :) )
Article Comments
Hi Erhard,
Thank you for the explanation. Yes, I think notification is the way to ensure that we get - well - notified. As you say: the status will persist on scanning interval - so chances are that we won't see it changing its state if we test every e.g. 5 min. After having the sensor set up for a few days, I noticed the sensor going into Bad state a couple of times, so apparently, I wasnt' patient enough :)
Br,
Bjorn
Aug, 2015 - Permalink
Hi PDC,
you are right, WMI Eventlog Sensor is a bit tricky. Did you make sure that you put 0,0001 into "Upper Error Limit" as described here: https://helpdesk.paessler.com/en/support/solutions/articles/76000063288-my-event-log-sensor-ignores-changes-in-the-event-log-what-can-i-do
I just tested it myself using current stable version (15.3.18.3334) and the whole sensor goes into error state (not just the channel #/s turning red), although it takes a few seconds for the sensor to change its state.
There is however one little detail (or backdraw if you will) that is also explained in the aforementioned KB post: "This status will persist one scanning interval. If the filter does not match in the following scanning interval, the sensor will switch to status Up again."
You may want to consider setting up notifications additionally in this case using a State Trigger to not miss an occurred event matching your desired criteria.
Regards, Erhard
Aug, 2015 - Permalink