Overview
The Event ID monitoring test appears under the Operating System section for monitored servers.
Monitoring Benefit
The Event ID test reports the status of the warning and critical events found in the server's event logs. The ENow client queries the event logs periodically and surfaces what it finds as a monitored indicator, so events that would otherwise sit unread in Event Viewer become something you are told about.
The value is in the events you were not looking for. Most event log review happens after something has already gone wrong; this test brings warning and critical events forward while they are still just events.
How do we verify the monitoring test results?
1. Check the Event monitoring page in the ENow console. This is the record of what ENow collected. From EMS 8.0 onward, collected results are held in the ENow SQL database rather than in files on the web server, so the console is the place to read them.
2. Check the agent log on the monitored server. The client collects event information using a periodic WMI query, and logs that activity on the monitored server itself:
\Program Files (x86)\ENow\Mailscape Agent\LogFiles\EventAgent.logThis is the file to look at when the monitoring page shows nothing for a server — it will show whether the query is running and whether it is returning results. Note this is on the monitored server, not the ENow web server.
3. Confirm the event exists on the server. Open Event Viewer on the monitored server and locate the reported event. The event text carries the detail the indicator cannot: the component that logged it, the failure, and often the remedy.
4. Establish whether it is recurring. A single warning event and the same event every few minutes are different problems. Filter the Event monitoring page by server and event ID across several days to see the pattern.
Common warning or error results, and potential solutions
| Result | Potential solution |
| A warning event is reported | Locate the event in Event Viewer on that server. Warning events are frequently precursors — worth reading rather than clearing, particularly where they recur. |
| A critical event is reported | Treat as a live fault on that server. The event text identifies the component and the failure. |
| The same event repeats continuously | Recurrence is the signal. Use the Event monitoring page to establish when it started and whether the rate is increasing. |
| No events shown for a server that should have some | Check EventAgent.log on that server. If the WMI query is failing, the monitoring page will show nothing rather than reporting an error. |
| Nothing has updated for any server since a particular time | That pattern points at the ENow SQL database rather than at any one agent. Confirm the ENow web server can still reach and authenticate to SQL. |
| An expected, benign event keeps alerting | Where an event is known and accepted in your environment, use Alert Exclusions to suppress that specific event rather than disabling the test. |
Related monitoring tests
- On domain controllers, AD Events under AD Replication watches specifically for Active Directory replication event IDs.
- DFS Replication Events monitors SYSVOL and DFS replication events.
Comments
0 comments
Please sign in to leave a comment.