MonitorWare Knowledge Base

[miket]

I'm running MWAgent 4.1 on a Windows 2000 server and have the windows event log being sent to my syslog server (Kiwi) via TCP. Recently the server was restarted but my syslog server never saw an Event 512 come in from the server. I did receive numerous events in the syslog server from the restarted server about various services starting up, but no 512 message. I checked the restarted server's event log and there was a 512 event in the log. Any ideas why this event message would not be sent? FYI - This same server has sent me 512 events in the past when it restarted but not this time. I thought using TCP would ensure delivery of the message. We create compliance reports using this data and the 512 event is a critical one that we need to report on. Thanks for your help.

[alorbach]

Hi miket,

this sounds very strange. Have you reviewed the application eventlog for error messages from EventReporter?

If there was a failure, you should see an error message there.
However even if the action to send syslog over tcp failed, the last record is not incremented which means the event will be retried next time.

Maybe examining the EventLog will find some more hints.

best regards,
Andre Lorbach