LabTech Support Forums

Add event exclusions to monitor

This forum is for discussion of alert related issues.

Moderator: jware.connectwise

Add event exclusions to monitor

Postby wroberts.connernetworks » Mon Dec 23, 2013 8:35 pm

I've got a few servers alerting on what Microsoft calls "benign" errors on SBS servers. How can I set up exclusions to the event log monitoring to ignore specific event IDs on servers running SBS 2011? I've tried to build and run queries and have gotten nowhere fast...

To keep it simple here's what I'd like to see:
Take the following default query:
Eventlogs.Source like 'disk' and timegen > DATE_SUB(CURRENT_DATE(), INTERVAL 1 DAY)

Add to exclude eventid 179533 if the OS is Windows SBS 2011. (bogus event ID by the way).

Thank you for your help!

-Will
wroberts.connernetworks
Newbie
Newbie
 
Posts: 3
Joined: Fri Nov 01, 2013 1:48 pm

Re: Add event exclusions to monitor

Postby michael.michaelpriest » Fri Jan 03, 2014 10:06 pm

Hi Will,

I'm assuming you are referring to the "EV - Drive Errors and Raid Failures" monitor.

Default Configuration:

Image

What you need to do is add the following into the Additional Condition's section

"AND Eventlogs.EventID NOT IN(175933)"

If needed you are able to add multiple EventID's into the Criteria by doing "Eventlogs.EventID NOT IN (175933,12345,12346,12347)"

New Configuration:

Image

Regards,
Michael Priest
http://www.ninitesolution.com
Regards,
Michael Priest
http://www.ninitesolution.com
michael.michaelpriest
Newbie
Newbie
 
Posts: 25
Joined: Fri Apr 19, 2013 9:13 am

Re: Add event exclusions to monitor

Postby kearnest.internetcontrasts » Thu May 12, 2016 10:22 am

Sorry to necro this thread, but i am having an issue with a query not working to get rid of a NETLOGON system log from generating tickets, i attached a screen of what i used, but the alerts are still showing in the query
Event logs.GIF
(150.2 KiB) Downloaded 3 times
kearnest.internetcontrasts
Newbie
Newbie
 
Posts: 1
Joined: Thu May 12, 2016 10:08 am

Re: Add event exclusions to monitor

Postby kemtis.buschconsulting » Thu Jul 07, 2016 3:49 pm

kearnest.internetcontrasts wrote:Sorry to necro this thread, but i am having an issue with a query not working to get rid of a NETLOGON system log from generating tickets, i attached a screen of what i used, but the alerts are still showing in the query
Event logs.GIF


Try remove h_eventlogs
kemtis.buschconsulting
Full Member
Full Member
 
Posts: 137
Joined: Mon Oct 31, 2011 9:36 am


Return to Alerting

Who is online

Users browsing this forum: No registered users and 1 guest