i have windows eventlog
there is two events in windows log:
1. id 1011 with text: "Server 'severX' in server farm 'Y' is being marked unhealthy due to health check status code failure." - problem for me
2. id 1001 with text$ "Server 'severX' in server farm 'Y' is being marked healthy." - problem solved for me
X is multiple value, such as, server1, server2, server3, server4 and Y is multiple value too, such as, 1, 2. for example: server1 and server2 in farm 1, server3 and server4 in farm 2
i have item (type is Log) with key: eventlog[Application,,Warning,"Application Request Routing",1011,,]
i can create trigger like: {check windows eventlog:eventlog[Application,,Warning,"Application Request Routing",1011,,].logeventid(1011)}=1 and with recovery expression {check windows eventlog:eventlog[Application,,Information,"Application Request Routing",1001,,].logeventid(1001)}=1
BUT the problem with event id 1011 can be generated for sever1 and farm 1 and after that in eventlog can be generated event with eventid 1001 for server3 (not server1!) and farm 2 (not farm 2!)
how can i get 'severX' and 'Y' from item value as variables in trigger ?
its helps me create trigger like: {check windows eventlog:eventlog[Application,,Warning,"Application Request Routing",1011,,].logeventid(1011)}=1 and server=$server and farm=$farm, recovery expression like: {check windows eventlog:eventlog[Application,,Information,"Application Request Routing",1001,,].logeventid(1001)}=1 and server=$server and farm=$farm
thanks in advanced
there is two events in windows log:
1. id 1011 with text: "Server 'severX' in server farm 'Y' is being marked unhealthy due to health check status code failure." - problem for me
2. id 1001 with text$ "Server 'severX' in server farm 'Y' is being marked healthy." - problem solved for me
X is multiple value, such as, server1, server2, server3, server4 and Y is multiple value too, such as, 1, 2. for example: server1 and server2 in farm 1, server3 and server4 in farm 2
i have item (type is Log) with key: eventlog[Application,,Warning,"Application Request Routing",1011,,]
i can create trigger like: {check windows eventlog:eventlog[Application,,Warning,"Application Request Routing",1011,,].logeventid(1011)}=1 and with recovery expression {check windows eventlog:eventlog[Application,,Information,"Application Request Routing",1001,,].logeventid(1001)}=1
BUT the problem with event id 1011 can be generated for sever1 and farm 1 and after that in eventlog can be generated event with eventid 1001 for server3 (not server1!) and farm 2 (not farm 2!)
how can i get 'severX' and 'Y' from item value as variables in trigger ?
its helps me create trigger like: {check windows eventlog:eventlog[Application,,Warning,"Application Request Routing",1011,,].logeventid(1011)}=1 and server=$server and farm=$farm, recovery expression like: {check windows eventlog:eventlog[Application,,Information,"Application Request Routing",1001,,].logeventid(1001)}=1 and server=$server and farm=$farm
thanks in advanced