FAQ Archives - Page 5 of 8 - MonitorWare Agent

How to install MonitorWare Agent in silent mode?

Because MonitorWare Agent is using the Windows Installer (MSIE) it is very easy to start the Installation in silent mode.
There are two ways to do it.

1. Using the MonitorWare Agent msi-file (Only possible if Windows Installer version 2.0 is installed on the target machine)
The msi-file has to be started with the following command line options (Using a sample File location):
msiexec /i C:\SetupFileName.msi /qn

2. Using the WinSyslog setup-file (Only necessary if Windows Installer 2.0 isn’t installed – a reboot might be necessary).
The setup-file has to be started with the following command line options (Using a sample File location):
SetupFileName.exe /v”/qn” /s

For more informations about the Windows Installer command line options see: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/msi/hh/msi/app_73eb.asp.

How can I copy the current configuration to the other servers?

Created 2004-01-26 by Tamsila-Q-Siddique

I have got “x” number of copies of EventReporter, MonitorWare Agent or Winsyslog. How can I copy the current configuration to the other servers so we can save time? I want to copy all of the services and rulesets I’ve setup on my server.

Please do the following:

Go to Computer Menu-> Export Settings to Registry-File (Not Binary).
Save this registry file.

Now put this registry file in a shared folder. Then on each computer you would just have to double click on it. When you double click on this registry file it would simply import your registry settings into EventReporter, MonitorWare Agent or WinSyslog. When you open the EventReporter, MonitorWare Agent, or WinSyslog you would see your configured rules and services.

Note: If you are using Windows XP / Windows 2000 and want to export your settings from EventReporter, MonitorWare Agent or WinSyslog to WinNT 4.0 machine then follow the following steps:

Start -> Run.
Type “regedit” and click ok – Now the Registry Editor is opened.
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Adiscon\EventReporter (MonitorWare Agent or WinSyslog) click on the “EventReporter” (MonitorWare Agent, WinSyslog) folder.
Go to Registry Menu -> Export Registry File…
Now give the file a name, like “myeventconfig” and change the “Save as type” to “Win9x/NT4 Registration Files (REGEDIT4)”.

Now you have a registry file that can be used for distributing your configuration across your WinNT 4.0 machines. If you don’t follow this procedure, you will not be able to distribute your Windows XP / Windows 2000 registry file to NT machines.

Do I need a new Key for an Upgrade?

Created 2004-01-23 by Tamsila-Q-Siddique

Will the same key work when I upgrade from 1.x version to 2.x version?

You can use this license key for any 1.x version of MonitorWare Agent. But this license key will not work if you want to upgrade from 1.x to 2.x and it will also not work if you want to switch from e.g. professional edition to enterprise edition. It calls for a new license. If you had got a new license and aren’t sure what to do follow these simple procedure.

Note1: But if you have got an UpgradeInsurance ID please contact support@adiscon.com for further details.

Note2: We assume you already have installed the trial version. If you do not have it installed, please visit the product web site and download and install the product first.

Download MonitorWare Agent from http://www.mwagent.com/en/Download/
After downloading the software start the client application.
Switch to the “License” tab.
Enter the License Name and License Key into the respective fields.
Click “OK”

This process will switch the product from the trial version to the licensed one. Be sure to enter the license name and license key exactly as provided by us. Remember that the license key information is case-sensitive. Documentation on how to enter the license key is in the manual. If you still encounter problems, please go throught this License Information FAQ.

Note3: Different Editions and Versions of MonitorWare Agent are availabe.

What does Event ID 1011 mean?

Created 2004-01-16 by Tamsila-Q-Siddique

What does event 1011 mean?

Our MonitorWare Line of Products e.g. EventReporter, MonitorWare Agent etc. periodically reads the Windows Event Log. While reading the Windows Event Log, they try to read the last record that was processed in the last run. We had opt for this, because if the last record doesn’t exist, then either someone had messed up with the Windows Event Log or the Windows Event Log was truncated. When MonitorWare Line of Products can not read the last record, then two things happen:

MonitorWare Line of Products send an Event ID 1011 to the Application Event Log stating that the Log has been truncated (this can be disabled by unchecking the “Report Log Truncation” checkbox in the configuration program).
MonitorWare Line of Products re-set the counter to the begining of the Windows Event Log.

Number 2 is done because there is no better way to resume processing, especially when the last record could not be found (it would be guessing where to begin). Please note that this can lead to message duplication.

This condition is normal when someone has cleared the event log in question. However, if that is not the case, seeing an 1011 event is a good indication that somebody has messed up with the event logs.

If you receive multiple 1010 events and you know this is fine based on your configuration, you may want to look at our step-by-step guide to limiting the number of consecutive events received.

What is the difference between MonitorWare Agent Workstation and Server?

Created 2004-01-13 by Rainer Gerhards

What is the difference between MonitorWare Agent Workstation (WS) and Server (SRV)?

The basic difference is based on the operating system the product runs on. If it is a workstations operating system like Windows XP, you need MonitorWare Agent Workstation. If it is a server Operating System like Windows Server 2003, you need the Server version. Other than that, some limits are different for the different editions.

To learn these exact differences, please visit the MonitorWare Agent Edition Comparison sheet. Please note that in that sheet “WS” means the workstation version while “SRV” means the server version.

Timestamp in field “ReceivedAt” and “DeviceReportedTime” stored in the database is wrong ?

Updated 2003-12-05 by Tamsila-Q-Siddique

The local PC-Time and other reported device time is correct but the the time stamp in “RecievedAt” and “DeviceReportedTime” field stored in the database is wrong ?

The time in field “ReceivedAt” and “DeviceReportedTime” which is stored in the Database Table (e.g. MySQL, SQL Server) isn’t actually wrong. In the database logging action (the one you had defined) the value for these fields are set to UTC by default. Because of this setting you would see a time difference in the database. For example a person living in UK, won’t even notice this because he is actually on UTC!

Please do the following if you face this situation:
1. Go into the action that you had defined for Database Logging.
2. Set the time for “ReceivedAt” and “DeviceReportedTime” to “Localtime”.

Does UNC Pathes work for WinSyslog, EventReporter and MonitorWare Agent ?

Created 2003-11-21 by Tamsila-Q-Siddique.

When UNC (\\severname\sharename\path) was given in the file path (in your defined “Write to File” action) Winsyslog, Eventreporter and MonitorWare Agent didn’t work?

Yes, UNC works for Winsyslog, Eventreporter and MonitorWare Agent, but due to Windows design you must meet some pre-requisites to enable them to actually work. They do NOT work in the default configuration. This is because WinSyslog, EventReporter and MonitorWare Agent are installed to be running under the Windows local system account. This account is restricted from network I/O by Windows design. To use a UNC name from a service (like WinSyslog, EventReporter and MonitorWare Agent ), please do the following:

Create an account that has permissions to actually access the UNC share
Then, you must grant it “log on a service” rights so that the service can use it.
Also make sure that it has permissions to access all local resources needed.
Then, go to Windows Services Manager and change the service account to the new one.
Now you are able to access the UNC share.

Records are not displayed on the Web when MYSQL was the underline database ?

Created 2003-11-19 by Tamsila-Q-Siddique

Records are not displayed on the web when I use MySQL ? Records aren’t displayed on the web when I use MySQL. The data isn’t retrieved even though the database is being populated and logs are being generated.

Note that MySQL under Linux requires “case sensitive” in the most cases. MySQL database tables and, field names should match with the ones defined in your “Data Base Logging Action”. That’s why records aren’t displayed on the web when MySQL is the underline database. For doing this do the following:
* Ruleset – > Actions – > Data Base Logging.
* MySQL -> (Databases)… -> Database -> YourDataBase (where YourDatabase could be any name).
* Check that the table names and the field names defined in the Data Base Logging and YourDataBase should match exactly.

Error on startup (Error event ID: 7026) explained.

Created 2003-11-06 by Andre Lorbach.

Many Adiscon products (e.g. WinSyslog, EventReporter or MonitorWare Agent) are available in a 30 days trial version.
After this time, the Service will stop working and if you are not logged on interactive, you will not see an error message. However, an error message in the application eventlog is generated by the system. It looks like the following:

Event Type: Error 
Event Source: Service Control Manager 
Event Category: None 
Event ID: 7023 
Date: xx/x/xxxx
Time: x:xx:xx AM 
User: N/A 
Computer: MYCOMPUTER
Description: 
The service terminated with the following error: 
The system could not find the environment option that was entered.

The reason why you get this error is, because your trial is expired.
The Service will skip initialization and the system will catch this with the error above.
What to do if you purchased the software, entered the license name / key and you still get this error?

1. Check the license name, it has to spelled correctly and to be case sensitive. Otherwise the license will not work.
2. Contact support@adiscon.com for further assistance.

Trouble with a non-Adiscon product? Then see this description of event 7026!

Do you want to control your Windows Server/Workstation events and get alerted on errors?
Take a look at the EventReporter product website!

Analysis, monitoring, near-real-time alerting of the Windows event log can be done with EventReporter.

Take a Quick Tour to EventReporter to know more about its exciting features or directly download the free and full-featured 30 day trial version.

What is the difference between SETP and Syslog?

Created 2003-10-21 by Wajih-ur-Rehman

What is the difference between SETP and Syslog and what advantages does SETP offer over Syslog?

Following are some of the points related to traditional Syslog:

Its a UDP based protocol.
It doesn’t provide any guarantees of message delivery.
It doesn’t parses the data so most of the fields of MonitorWare Database would remain empty, if Syslog is used to send data to the database.
It is supported by EventReporter, WinSyslog and MonitorWare Agent.

For more details about Syslog, please visit:
http://www.monitorware.com/common/en/articles/syslog-described.asp

Following are some of the points related to SETP:

Its Adiscon’s proprietary protocol.
Its a TCP based protocol.
It provides guarantee of message delivery.
It parses the data out and hence all of the fields of MonitorWare Database would be filled.
It is supported by WinSyslog 5.0 Enterprise Edition and MonitorWare Agent (EventReporter 6.0 will also support SETP sending)
Since MonitorWare Console expects that all of the fields of the database have some values in it, it generates more meaningful reports with SETP as compared to Syslog (with which most of the fields are empty)

One thing to keep in mind is that if you are sending the data using SETP protocol, then on the receiving end there must be a SETP listener to receive that data. So, in no case it is possible that you send the data using MonitorWare Agent (which supports SETP sending) and receive that data using WinSyslog 4.x (which doesn’t support SETP receiving).

Please note that the syslog restrictions mentioned here apply to traditional, UDP based syslog. There are newer syslog standards available, most importantly RFC 3195. Adiscon is one of the yet few supporters of these new standards. With it, the reliability issues of syslog are solved. However, there are still length isuses, so that this is not the final solution. Adiscon is actively working with the standards bodies to improve syslog protocol’s capabilities. We hope that, in the medium to long term, we can provide the same benefits SETP offers over standardized syslog.