FAQ Archives - Page 6 of 8 - MonitorWare Agent

Setup Error 1923

Created on 09-10-2003 by Lutz Koch.

I receive error 1923 when installing a MonitorWare Product like EventReporter, WinSyslog or MonitorWare Agent. What to do?

If you update one of those Products to a newer Version, you might get the following warning message:

Cause:
If you changed the Services properties (for example the Log On settings), the Installer will detect that the installed Service does not match that one from the Installation Package. So this Warning message is shown to inform you about this.

Resolution:
Just click the ignore button, the EventReporter, WinSyslog or MonitorWare Agent Service will be correctly updated, and custom changes in the Services properties will remain.

Step by Step Guide for Viewing Syslog Messages on Web

Created 2003-08-07 by Wajih-ur-Rehman

Can you give me step by step guidelines for viewing Syslog Messages on Web?

Here is the step by step procedure for configuring Online Web interface for viewing Syslog Messages.

First, make sure that IIS is installed and running. Then follow these steps:

1. Download the zip file from one of the following links depending on your product version:

ZIP file for WinSyslog 4.x and MonitorWare Agent (10 KB) (If you have WinsSyslog 4.x or higher, MonitorWare Agent or EventReporter)

ZIP file for WinSyslog 3.x (10 KB) (If you have WinSyslog 3.x)
2. Unzip the file. It includes some .asp files and a Help.html file. (In this Help file, all the details are given). Copy all of these files and put them in the folder “inetpub\wwwroot\YourFolder”

where YourFolder could be any name.

3. Now open the ConfigSettings.asp page. There you will find many variables. The most important ones that you would HAVE to set are the following:

' *** Name of ODBC *** strODBCName = "NameOfMyDSN"

‘ *** Userid of ODBC ***
strODBCUserid = “sa”

‘ *** Password of ODBC ***
strODBCPwd = “”

Where NameOfMyDSN is the DSN name that points to your database. For Microsoft Access, you don’t have to specify any userid and password.

There are some other variables which you can set to filter events. Once you are done with this ConfigSettings, simply save this page.

4. Now open up the browser and write the URL. In the example that I am giving you it will look like this:

http://localhost/YourFolder/Default.asp

It will show you syslog messages from the database on the web (according to the filter conditions that you have set in the ConfigSettings.asp variables)

How to monitor a file on a remote machine?

Created on 2003-08-07 by Michael Meckelein.

By default, MonitorWare Agent service uses the local system account. This account has no permission on remote machines. If you want to monitor a file on a remote system, the MonitorWare Agent service must log on as a user with administrator rights. This user must be exist on both system, local and remote. Also be sure, that the password is equal on all machines or – preferrably – use a domain account.

Here are the steps for monitoring a file on a remote machine:

Add a File Monitor service
Use an UNC name for ‘File and path name’, e.g. \\remotemachine\share\filename.log
Go to administrative tools -> Services
Right click on AdisconMonitorWareAgent and select properties
Select the ‘Log On’ tab and check Log on as: ‘This account’
Enter a user with admin rights, this user must still exit on the remote machine!

Logging to Different Files

Created 2003-08-05 by Wajih-ur-Rehman

How can I log the data from different devices to different files?

You can log the data of different devices in different files with just one click! Simply check “Include Source in file name” and restart the service. Different logfiles will be created and each filename will include the source of the message. It will now write the logs of different devices in different files.

Database Connection Problem

Created 2003-08-05 by Wajih-ur-Rehman

I am unable to Log the data to the database although I have provided the DSN to the software?

Please note that even if you have created the DSN with some login and password, you would still have to write that login and password in the Graphical User Interface of the Client program in proper text boxes because it creates the connection string using the name of the DSN, the login and the password.

Error opening language file

Created 2003-08-05 by Lutz Koch

When I start a MonitorWare Product, I get the following error:

“FATAL error opening the MonitorWare/WinSyslog/EventReporter/MoniLog language file. Please repair this using the Monitorware/WinSyslog/EventReporter/MoniLog Installer”

The reason for this error is that the language file got somehow deleted or renamed. This can occur with MonitorWare Agent, WinSyslog, EventReporter as well as MoniLog. To solve the problem, make sure the according language file is in your program directory.

You can download the files here:

How to use the Event Severity filter?

Created 2003-07-29 by Andre Lorbach

The ‘Event Severity’ can be used to filter by event type. The following values are possible and valid:

EVENTLOG SUCCESS	1
EVENTLOG ERROR TYPE	2
EVENTLOG WARNING TYPE	4
EVENTLOG INFORMATION TYPE	8
EVENTLOG AUDIT_SUCCESS	16
EVENTLOG AUDIT_FAILURE	32

To filter by multiple event types, you can use an OR filter on the top level and multiple Event Severity filters below. In this sample, you wil see Event Severity with ERROR TYPE and WARNING TYPE:

Adiscon products and the Microsoft SQL Server 2000 Desktop Engine

Created 2003-07-24 by Lutz Koch.

How do MSDE security risks relate to Adiscon products?

As a general policy, MSDE is *not* installed with any of our products.
Even though this may cause some additional setup work for customers, we have decided to do so because of vulnerability issues of MSDE. If you decide to install MSDE however, we think that you should be aware that you install a potentially dangerous, large piece of software.

If you are concerned on MSDE security, you may want to use MySQL instead of MSDE. We do offer full support for MySQL.

What is “Event ID 107”?

Created on 2003-06-16 by Usman Khawaja

Message: “Couldn’t read last record for Security log (state 87) – nLastRecord set to 0 to recover.”

This actually is no error, but a status message. There can be three reasons for this message:

This message occurs when by any chance the last entry in the event log gets deleted. By the network administrator or however. Because of this, nLastRecord (which keeps the track of last entry in the event log), which contains the last event log record read (of the particular event log part), is reset to 0. This parameter is usually not to be modified. If you would like to get a complete dump of your event log instantly, enter 0 in this parameter. There is a setting for this message in the options of the event log monitor service, called “Report truncated log”. If this option is checked, the message appears if a log is somehow truncated.
If for any reason EvntSLog is unable to read the event log (e. g. truncated by administrator), it will reset nLastRecord to 0 automatically (that event, too, is logged in the NT application event log). The EventReporter manual will give you more information on this message.
There can be one more reason for this message; that the Eventlog has become corrupted at some position. You can verify this by scrolling through the Eventlog with the EventViewer. If it is indeed corrupted, an error message will pop up.
Third party applications that run on the same machine and interfere or lock the event log. One such application is the ISS RealSecure Server Sensor.

Please note that this information is only applicable to EventReporter 6.x and MonitorWare Agent.

How to setup file monitoring for ISA Server?

Created 2003-05-23 by Lutz Koch.

How to setup file monitoring for ISA Server?

Since ISA Server logfiles are W3C based simple textfiles, they can be processed by MonitorWare Agent. To monitor the ISA logfiles, you just have to setup a File monitor service in the Agent:

Right-click on the services node and select “Add Service”. Then, select the File monitor service from the list. In the File monitor options, select the ISA Server logfile for “File and path name”. The File monitor service can be configured to check the file in very small time intervals, e.g. 1 second, so the monitoring is even near realtime.
The 2.x release of MonitorWare Agent has a special option for logging W3C-WebServer logfiles.

Once the file monitor is completely configured, you can setup MonitorWare Agent to perform various actions, such as sending an email or a syslog message. Please also see the FAQ “How can I forward IIS logs to a syslog deamon?” for information on IIS logfile monitoring and forwarding.