All Discussions - NETIKUS.NET

ODBC Error, Setting up Profile to Oracle DB

Darkvette — Wed, 08 Feb 2012 11:26:28 -0500

Hello,

I am running ES 2.92.11 on a Windows Server 2008 R2 64-bit Server.

Our database is Oracle, and I do have the Oracle 11g R2 32-bit client installed on the box as well.

32-bit ODBC is configured properly and ES can communicate with the Oracle DB just fine.

When I went to setup the Web Reports, I got everything setup properly, then upon going to setup the connection to the Oracle Database, I get the below error.

Attempt Failed. Error -2147467259
[Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified

Here is my ODBC connection String (same one used in the ES Database Connection):

Dsn=esprd;server=ESPRD.myserver.COM;uid=eventsentry_web;pwd=

Everything else works just fine, except this. I'm at an impass, and need help to get this working.

Thoughts?

Syslog huge...

Steve_W — Mon, 06 Feb 2012 09:57:58 -0500

In our DB usage 'syslog history' says it's 32gb, how I can I identify which server is taking all the space and purge it to clean it up then identify why it's so large.

Ip monitor

Private Private — Sun, 05 Feb 2012 14:16:08 -0500

Running windows small business server. Gateway ip monitor 1.40. Test email confirmed working. Confirmed working as window service. I am not getting scheduled interval emails that was set for every 1 hr as test. I clicked apply and made sure changes were saved. Suggestions?

Compliance>Account Changes>User Account ASP errors

Matt Brown — Mon, 06 Feb 2012 23:14:35 -0500

Event Sentry web reports installed on Server 2008 R2. All aspects of web reports working expect for Compliance > Account changes.

Friendly errors are off and I am getting the following error when the search button is clicked.

error 'ASP 0156 : 80004005'
Header Error

/EventSentry/eventsentry_tracking_users.asp, line 1276

The HTTP headers are already written to the client browser. Any HTTP header modifications must be made before writing page content.

Cheers

trying to install 2.92 on windows 2003 SP2 getting Wizard was interrupted error. Pls help

Suchit Patel — Fri, 03 Feb 2012 18:31:04 -0500

I am trying to migrate a current eventsentry to a new server. I backed up the .reg file and installed it on the new server. I started the install and everything is normal till I hit the install button. As I hit the install button it starts the install bar does a few things and kicks me out to the finish screen with the following error.

"The wizard was interrupted before EventSentry could be completly installed. Your system has not been modified. To complete installation at another time, please run setup again"

I tried running setup again multiple times after rebooting the server no avail... please help

Manual Package Download?

ChrisG — Mon, 01 Feb 2010 05:27:13 -0500

Hi,
Is there any way I can download the latest ES packages and apply them manually to my installation?
Our EventSentry server does not have internet access, so the menu option to download packages in the console doesn't work.

Thanks,

Chris.

Reconfigure Repair brings u Error 27502

Georg — Tue, 10 Jan 2012 16:37:49 -0500

Hi,

I wanted to Recconfigure / Repair my EventSentry Setup. After copying the files I get an error

"Error 27502. Could not connect to Microsoft SQL Server 'SERVERNAME'. Login failed for user 'sa'. (18456)"

EventSentry is configured for Microsoft SQL Server. In the registry I found in
HKLM\Software\netkikus.net\EventSentry\Installer that the dsn "EventSentry MSSQL" is used.
I cheched this dsn and it is correct. What I can't find in any way is the configuration for the user used to access the SQL Server with this dsn.

Any ideas on this.

This EventSentry installation runs on an Windows Server 2003 R2 SP2.

Thanks for an answer
Georg

Email Notifications

Brad Babin — Thu, 22 Jul 2010 08:38:51 -0400

I recently removed an email address from the receipients group in the Default Email Section. This user continues to receive emails though. I restarted the services and he stopped getting them for about 12 hours or so and then they returned. Am I missing something?

Account Lockout/Account Unlock

wriley — Tue, 10 Jan 2012 12:34:27 -0500

We are currently running an environment with both Server 2003 and Server 2008 R2 domain controllers and would like to receive notifications of when a user's account has been locked out or unlocked. If possible, we would like to be able to run a report on these events so that we can show that to the powers that be. Is it possible to receive notifications for when the accounts are locked out or unlocked for our environment and is there a reporting tool that we can use to generate the needed reports. Thank you.

How to stop EventSentry from sending old notifications

officialCOMMUNITY — Tue, 10 Jan 2012 14:25:59 -0500

If we get a flood of issues for whatever reason we keep getting them for days after the fact. So today every 5 minutes we are getting emails with logs from 2 days ago. Is there a way to purge everything up to this point so EventSentry stops sending old events?

Thanks.

EventSentry 2.92 uses SysWOW64 for temp, log files

John Wells — Wed, 04 Jan 2012 14:19:06 -0500

I recently upgraded to EventSentry 2.92 light on Server 2003 x64. After this BackupExec started warning of files in Windows\SysWOW64\eventsentry\temp that couldn't be backed up. I see there's also an eventsentry\log folder there.

Why aren't temp and log files being stored under All Users\Application Data, rather than Windows\System32 or SysWOW64?

How to avoid this email: EventSentry missed events between x and x.

Keith Sauer — Thu, 22 Dec 2011 07:44:32 -0500

For one of our servers we keep getting this email every 3 minutes...
When monitoring the Application event log, the EventSentry agent missed events between number 66532633 to 66532676. EventSentry will attempt to read those events at a later time to make sure that all events from the Application log are being processed.

The numbers change a bit with each e-mail. Is there a way to stop this?

EventSentry - Embedded scripts do not support arguments?

Mike Wang — Wed, 28 Dec 2011 17:13:52 -0500

I tried to do a scheduled application for an embedded script with arguments but I keep getting this error:

The process @my_script.js hello could not be created due to the following error:
The system cannot find the file specified.

For some reason it is not evaluating the @my_script.js to the path location when I add the "hello" argument. When I remove it everything works fine.

Threshold Setup...

Mike Scott — Fri, 13 Aug 2010 12:07:49 -0400

I would love some advice on the best way to setup thresholds. Currently, when we get a "breakout" of events, after the fact, we setup a Threshold on that particular event. I'd love a way to have a "Global" threshold that would automatically kick in at a specified limit for any identical events. Thus far I haven't found any easy way to accomplish this and I'd hate to have to manually go through the existing Allow Filters we have and add the threshold to all of them manually.

No reports for File Access tracking

TomO — Tue, 06 Dec 2011 17:40:25 -0500

Running EventSentry 2.82.11.
I setup File Acess tracking for a Windows 2003 server about a month ago. I enabled file access auditing for the local security policy on this server and verified that events are coming into the Security event viewer.
A day after I setup the tracking I went into my web reports server and was able to run a report under Compliance > File Access, get results and show a chart.
Today I went back to run another report but no results get returned. If I try to group by computer and check the Show Chart checkbox I get an error:
Microsoft VBScript runtime error '800a0006'
Overflow
/eventsentry/eventsentry_tracking_object.asp, line 1603

It also says that Flash is required, but I have verified it is installed and working properly on my PC.

Email flooding (can it be avoided?)

Keith Sauer — Thu, 22 Dec 2011 07:40:33 -0500

We had 2 instances of email flooding where our inbox receives THOUSANDS of e-mails for the same thing. One was that one of our admin's exchange inbox was full. Well each member of the IT team got well over 15,000 emails stating that. Um.... 1 email would of been enough, thank you!

Then we inadvertently ran out of space on one server's C: drive (working on it...), and we got over 8500 eventsentry emails for THE SAME ERROR! MSSQLServerOLAPService event 11 (cant write a log file). Again 1 email would of been enough. Is there any way to configure EventSentry so that when it sees a duplicate event within that short amount of time to not send an email if it already did?

Just with literally thousands of emails on for the same issue is hard to manage. Especially if your on a mobile device trying to download a 10,000 message inbox over a 3G connection. It then becomes more of "the boy who cried wolf" syndrome where people start creating rules in Outlook to "permanently delete" certain messages (yes I'm guilty of this myself). It looses it's luster because people start to think "oh there's another event sentry message clogging my mailbox - delete!". That kind of defeats the whole purpose of the system.

Thanks so much for your help! Our entire team appreciates it!

Not receiving alerts from our Server 2008 DC

Josh Almeida — Tue, 13 Dec 2011 15:21:56 -0500

Hi, we are using Eventsentry here to monitor all of our servers, we recently added in a new Server 2008 DC to be our "main" domanin controller and for some reason we are not receiving any alerts for changes made to user accounts on this particular DC. For example on all of our 2003 DC's if I add a new group to a user or remove one I get an email alert that I made the change. The 2008 DC is not sending any of these emails. I was able to successfully map over to the 2008 DC's admin share, push out the client and send an update to that machine but still no emails. This DC is part of our default DC group policy so it should have auditing turned on but if I look at it's local security policy "audit logon events" is not configured even though is should be configured via group policy, I can't make any changes to the local policy because it is greyed out.

Any ideas?

try installation on Server 2008 x64 doesnt work

Michael Grawe — Mon, 12 Dec 2011 12:02:27 -0500

Hello

i try the installation from eventsentry light on Server 2008 R2 sp1 x64 The installation is working till the services want to start and then i get error 1920 services can not start.
One Server 2003 it is working

I lwas logging in with the localadminaccount and i gave the Services my credentials with dommaine\adminisaccount +passwort but i doesnt work.

Thanks

multiple events per email

BillAy — Sun, 06 Nov 2011 07:57:43 -0500

We like email alerts. Much of the time the email subject (which includes the computer name) can give us what we need to see, so we don't need to open the email, just scan the Inbox.

When we first purchased EventSentry we configured alerts to send multiple events in each email. The problem there was that the subject is pulled from the first alert that's ready to send. So if there is a relatively innocuous event followed by something more serious, the serious event is effectively hidden. We switched to a single event in each email, which tends to generate lots of emails.

I would love to have an option to combine multiple events in the same email, but only the same type of event - for example tracking/services. One email could contain an arbitrary number of these events, but a separate event - like a change to local admins on a box - would generate a separate email. That way something that you'd normally want to look at quickly wouldn't get lost in the noise.

Any chance of an enhancement?

Exclude Filter Not Working

Blaine Kehl — Wed, 07 Dec 2011 15:21:38 -0500

I am trying unsuccessfully to set up my first exclude filter in EventSentryLight.

Steps I used to create filter:
1. Connected to the remote event log viewer in the EventSentryLight management console.
2. Right clicked the event and selected Add Exclude Filter
3. Gave the filter a name and associated it with the default package.

General Filter Settings
Actions: Checked trigger all actions.
Log: Checked Application
Event Severity: Checked Warning
Filter Settings: Exclude
Event Source: Microsoft Operations Manager
Category: MOM Agent
Event ID: 25012
Username: NT Authority\System
Computer: left blank
Content Filter & Notes: none

Clicked save.

I continue to receive this email re. this event.

EVENT # 17078
EVENT LOG Application
EVENT TYPE Warning
OPCODE Info
SOURCE Microsoft Operations Manager
CATEGORY MOM Agent
EVENT ID 25012
USERNAME NT AUTHORITY\SYSTEM
COMPUTERNAME VCENTER
DATE / TIME 12/7/2011 1:11:35 PM
MESSAGE The Application Event Log on computer '******\VCENTER' appears to have been cleared since it was last read. The Windows Event Log Provider may lose events whenever an event log is cleared.

What am I doing wrong?

incorrect ip address detected

Sihle Lunga — Tue, 25 Oct 2011 01:30:28 -0400

Hi everyone, please help!!! I have installed gateway ip monitor v1.4 on a machine running windows xp sp3. The problem is that when I use the default public ip detector website provided I get the correct public ip, but when i right click and choose show ip it shows another ip which is different from my router public ip. I use routed internet access connection, also an email address that is send to me is the incorrect ip and not the ip detected by the default website.

Error Event ID 580

Private Private — Fri, 21 Oct 2011 09:55:45 -0400

I have been getting this for while and can't figure out why? I have searched through the help file and the knowledge base but didn't fin anything helpful. I have stopped getting any other email notifications to my Blackberry. (even though they go to my Gmail)

EVENT # 5434
EVENT LOG Application
EVENT TYPE Error
OPCODE Info
SOURCE EventSentry
EVENT ID 580
COMPUTERNAME SAGETV-SERVER
DATE / TIME 10/19/2011 9:51:21 PM
MESSAGE Action "Desktop" was unable to create a mailslot for host "." due to error: The system cannot find the file specified.

upgrade to 2.92 broke my web reports

John White — Tue, 01 Nov 2011 17:51:23 -0400

Attempt Failed. Error -2147467259
[Microsoft][ODBC SQL Server Driver][TCP/IP Sockets]SQL Server does not exist or access denied.

Event ID 1041 using 2.92.0.11

Private Private — Mon, 24 Oct 2011 10:51:16 -0400

I have been getting multiple 1041 errors even though I'm already using 2.92.0.11

Heartbeat monitor doesn´t start anymore

Hajo Kumschlies — Thu, 20 Oct 2011 02:59:16 -0400

Hi,
my heartbeat monitor doesn´t start anymore:

Eventlog:

- System

- Provider

[ Name] Service Control Manager
[ Guid] {555908D1-A6D7-4695-8E1E-26931D2012F4}
[ EventSourceName] Service Control Manager

- EventID 7023

[ Qualifiers] 49152

Version 0

Level 2

Task 0

Opcode 0

Keywords 0x80000000000000

- TimeCreated

[ SystemTime] 2011-10-19T09:18:56.000Z

EventRecordID 194071

Correlation

- Execution

[ ProcessID] 0
[ ThreadID] 0

Channel System

Computer SMGE134.GE1.arnholdt.de

Security

- EventData

param1 EventSentry Heartbeat Monitor
param2 %%1610

Ein Logfile wird nicht geschrieben.

Bein Start :

C:\Windows\SysWOW64>eventsentry_hb_svc.exe /start

----------------------------------------------------------------
EventSentry Heartbeat Monitor V2.91 by NETIKUS.NET [ compiled on Sep 17 2010 ]
(support@netikus.net)
----------------------------------------------------------------

Service started successfully.
Service is stopped.

Enter eventsentry_hb_svc /start to start the service.
Enter eventsentry_hb_svc /uninstall to uninstall the service.

Who can help?

Can't export to CSV...sort of

Adam Miller — Fri, 21 Oct 2011 16:31:42 -0400

I can't seem to export to a csv file when I do a search for software. I get a "500 internal server error". I can export to .CSV file all other report such as hardware inventory or locked out account, or newly created computer accounts; but not the software inventory report...

Computer added to ES Management Console, but not to web report.

John — Mon, 29 Mar 2010 17:21:57 -0400

ES Gurus,

I have ES set up on a win 2k3 server, the clients are deployed on win xp pro boxes over our LAN. When I add a new computer, it does not show up on the web report. I believe this dovetails with another problem, roughly 50% of the computers are telling me "The specified service does not exist as an installed service." Most of the computers are showing up fine with heartbeat. My biggest hurdle is that the network is ever changing, and a device might legitimately not be there. That said, I have confirm this is not the problem in this particular cases (I can RAdmin in). Specifically, when I try to update the agent, I get the "admin$ share does not exist" message. I have both remotely logged in and checked it out, and verified with net share, admin$ is there. I have not tried to map a path yet, as this is pretty unrealistic for the number of devices on my network. I have tried both IPC$ and impersonation authentication.

What am I missing with getting these agents updated? Or successfully adding another computer?

Specs:
ES v2.90 build 24
Windows Server 2003 R2 SP2

Agents are on:
Windows XP Pro SP2
ES Agent 2.90

Thanks,
John

Error on Events -> Reports page

Scott Hudson — Wed, 12 Oct 2011 16:29:22 -0400

I get the following error on the Events -> Reports page:

Microsoft VBScript runtime error '800a005e'

Invalid use of Null: 'Replace'

/EventSentry/eventsentry_reports.asp, line 601

I was creating reports and noticed some odd behavior. I set the "Save Report for my user only" and the report did not show up on the list. I made another report then it said "Conditions are currently empty" and would not let me edit it again. I think these two events may have contributed to the error.

The performance counter "Process(*)\% Processor Time

Brian Hayes — Tue, 13 Sep 2011 13:36:01 -0400

Where is this value set?
60%
Thanks

Service History not displaying in web interface

Michael Shavelieva — Thu, 01 Sep 2011 10:20:36 -0400

When I try to view the "Service History" page fromthe web interface I select which server, click Search and this is what is displayed, doesn't matter which server I select.

ADODB.Recordset
error '800a0cc1'
Item cannot be found in the collection corresponding to the requested name or ordinal.
/EventSentry/eventsentry_service_history.asp, line 719

Here is the line from the file it is referring to
If DBRS.Fields("Startup").value <> DBRS.Fields("Startup_New").value Then

Any ideas how this should be resolved?