Kaseya Community

How to report on the number of times a specific entry is made to the Agent Logs?

This question is answered
Is there an easy way to report on the number of times a certain entry is made to the Agent Logs?

We are getting a script to write to the agent logs when a particular event occurs, and would like to be able to report on how many times this entry is written over N days.
We are using the Agent Logs and Agent Procedure Status datasets but cannot seem to produce the required result.

Verified Answer
  • Hi JB,

    I have been able to successfully create report parts that detail the specific number of times an event has taken place. To create a Bar Graph...you need to select 'Agent Procedure Name' as the Bar Category and the 'Log Time' as the Bar Value (with an aggregate of COUNT).

    The downside is that it will not report on 0 events.

    For example...if you want a graph to show backup success / failure and you have no failures for the last N days....then it will only show a single bar with the total value for all the Success events.

    Let me know if you need further info.

    Cheers

    Josh

All Replies
  • Do you have access to the database?  If so I find it's easier to query the individual daily event log tables or the vNtEventLog depending on the frequency with which you wish to query,  Then dump the data into Excel.

  • Thanks for replying Alastair. Unfortunately not, we are using the SaaS platform, and I'm beginning to wonder if it's a bag of crap.

  • If I've read things right then the SaaS platform is on 6.3 so I believe you should be able to use SQL queries in your reports.  Not something I've tested but I'm sure someone can chip in and confirm or deny.

  • That would help I guess, but we would need to know what the tables are, what data they contain, in what format etc to be able to use a SQL query. I don't suppose there is any documentation describing the database anywhere?

  • I don't know if you have access to the new reporting in 6.3, but if you do, you can make a report that tells you that.

    I am pretty sure that this will be what you are looking for:

    Create a new Report Part under Logs > Agent Procedure Logs

    Select whatever columns you would like for my test report part, I just made it Computer Name and Agent Procedure Name. Aggregate the Agent Procedure name by COUNT. #This will count the number of times that this log is seen for each computer.

    I ordered mine by computer name, but you can order it however you want.

    I didn't group my report.

    Under Advanced filter select:

    Agent Procedure Name, Operator is Like (or Equal if you want), Value is the name of the agent procedure that you are trying to measure.

    AND

    Procedure Step Description, Operator is Like (or Equal if you want), Value is the name output that you are looking to measure.

    This created a report for me that showed me how many times a specific job was run against this machine.

  • Hi Matt,

    Thanks for the reply. I have done exactly as you suggested above (I had already done this but had not included Procedure Step Description as a filter) but I am still getting no results or an error message.

  • I forgot to mention. Try Deselecting "Select Distinct" on the third page.

  • Thanks Matt,

    Tried it, no change :-(

  • Odd. For my advanced filter I used wildcards. For example, The procedure i tested it on is called Kill Quickbooks (a procedure run everynight in case anyone is in quickbooks) I want to know how many times it was successfully run. So i set my advanced filters values like this (without quotations): "Kill*" and "*Success*"

    Have you tried that?

  • Yep tried that one already too!

  • Yes,  

    If you use this dataset and build a table report part with advanced filters, you should be able to get what you need. 

  • Hi Chad,

    Sorry for the late reply. We were originally trying to use the event logs dataset, but it seemed that lots of events were missed/not picked up, so decided to try using an agent procedure to write an entry to the agent log when an event is recorded in the Windows event log, and then to try reporting on the entries in the agent log instead.

  • Weird. Having gone to back this after a few weeks on other tasks, it is now working without having to change anything! Maybe another SaaS weekend hotfix solved the issue. Now for my next problem.

    Having gotten the above to work, how can I create a pie or bar chart that shows both successes and failures? I am getting the agents to write success or failure events in the agent logs when the backup jobs succeed or fail, and can show this in a table or a chart, but cannot see how to get a table or chart to show both success and failure.

  • JB,

    Can you take a screenshot of the log you are trying to report on?  That would help.

  • Hi Chad,

    Sorry, I think I may have posted this in the wrong thread - I have a few active ones at the moment!

    Anyway, we have a load of different pieces of backup software that clients use that we need to report on, but as an example, below are event log alerts that have been configured for Symantec System Recovery Successes and Failures:-

    When we report on them, just using a basic table report part as a test, we have found that we have to set the advanced filters up as below, using the Like operator and surrounding the value we are looking for with asterisks to get results returned to us:-

    Obviously, this is fairly basic, but it was just to prove that we can grab the events from the event log. What we found when comparing the results from the generated report to manual backup checks was that there were quite a few missing. Sometimes it was better than others, but still a fair few jobs missing. As a test, after seeing posts from others saying that they had similar problems and had started reporting from the agent logs, we created an agent procedure to write backup success or failure entry to the agent logs, when one of these events was recorded, and then use the agent procedure logs dataset to build a report part from, and this seems to be much more successful.

    What we would ideally like to do would be amalgamate the successes and failures into one chart and or table, so that as part of monthly reporting for clients, they can see from a simple chart how successful their backups have been over the past month.

    For each type of backup software that we have to cover, we are creating event log monitors, as above with the codes/event IDs that each product creates in the event logs, and then writing a backup success or failure entry in the agent procedure logs, so we only need to report on those two entries now really.

    The final task will be tackling the backup software that cannot/will not write events to the event log, and backup software used on Mac servers, if it will be possible.