Kaseya Community

Erroneous Alerts for Monitoring Storagecraft

  • I have created a monitor set to monitor our storagecraft backups for completion.

    The set monitors the application log for eventid 1120 from a source of shadowprotectsvc. It looks to see that this alert is not missing from the application logs during a given 24hour period. If it is missing during a 24 hour period then we have missed a backup and need to investigate the issue.

    We stop our backups on Friday night and perform a second job on Saturday night that dumps a fuill backup to USB drives.

    The daily job restarts on Sunday night and continues hourly until Friday night.

    On Monday morning I came in to a FLOOD of alerts from backup jobs missed over the weekend. After sifting through everything I finally found several alerts that appear to be legitimate but erroneous and I am trying to figure them out.

    The alert that came in on 5/3 zt 3:17pm is:
    "Application log events did not occur for event set Storage Craft Backup Monitor Success on ndb-server.ndb.nen"

    This indicates that the agent found not source: shadowprotectsvc eventid 1120 events in the application event log from Sunday 3:17 to Monday 3:17.

    When I look at the event logs I found events every hour beginning at 6pm on Sunday evening and continuing through long past 3:17 on Sunday.

    I am confused as to why I would get an alert when the events are definetly showing up in the event log. I have screenshots to document all of this in case anyone needs to see this represented visually.

    Any help is appreciated.

    Thanks,
    Stuart

    Legacy Forum Name: Erroneous Alerts for Monitoring Storagecraft,
    Legacy Posted By Username: nenstuart
  • Just to start with the basics, on the Agent - Event Log Settings page, are you capturing Informational events in the Application log? Since I've migrated to K2 I've had it happen at least twice that my event log settings have gotten wiped out on some of my server agents for no reason. The way I've found this is that I started getting alerts about events missing that are clearly in the logs, just like you are.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: kcears
  • Yeah I thought of that but if that were the case the alerts would not cease through the week. It just seems to be when the backups stop for the weekend and restart on Monday. It's like it doesn't catch it or something.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: nenstuart
  • IMO...Instead of monitoring for 1120 events you should be monitoring for 1121 which indicates a backup has failed.

    Example:

    Log: Application
    Type: Error
    Event: 1121
    Agent Time: 9:00:00 am 13-Apr-10
    Event Time: 2:00:00 pm 13-Apr-10 UTC
    Source: ShadowProtectSvc
    Category: None
    Username: SYSTEM
    Computer: SERVER
    Description: Backup status: failed


    In addition, I would utilize the ShadowProtect agent in the console to alert you if a backup failed.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: GXR
  • GXR
    IMO...Instead of monitoring for 1120 events you should be monitoring for 1121 which indicates a backup has failed.

    Example:

    Log: Application
    Type: Error
    Event: 1121
    Agent Time: 9:00:00 am 13-Apr-10
    Event Time: 2:00:00 pm 13-Apr-10 UTC
    Source: ShadowProtectSvc
    Category: None
    Username: SYSTEM
    Computer: SERVER
    Description: Backup status: failed


    In addition, I would utilize the ShadowProtect agent in the console to alert you if a backup failed.


    For our backups, both with ShadowProtect and Backup Exec, we monitor for both failed and successful. That way if a job gets hung up for days for some reason (which has happened many times even if a job time limit is set in BE), then after 72 hours or whatever we will at least get an alert that there hasn't been any successful jobs, and we can then look into it. Much better than having the client ask us why their backups haven't been running for a week or two.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: kcears
  • GXR
    IMO...Instead of monitoring for 1120 events you should be monitoring for 1121 which indicates a backup has failed.

    Example:

    Log: Application
    Type: Error
    Event: 1121
    Agent Time: 9:00:00 am 13-Apr-10
    Event Time: 2:00:00 pm 13-Apr-10 UTC
    Source: ShadowProtectSvc
    Category: None
    Username: SYSTEM
    Computer: SERVER
    Description: Backup status: failed


    In addition, I would utilize the ShadowProtect agent in the console to alert you if a backup failed.


    We monitor for failures as well as successes. We want to know if a job has been placed on hold for 3 days because someone forgot to take the job off hold when they were done working on somnething....

    Got another round of alerts today btw. Seems to be only 2 specific servers. Everything appears to be correct from what I can tell. Just can't figure out why.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: nenstuart
  • Another interesting fact that I just found. The 4 servers I am having issues with are all windows 2008 servers.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: nenstuart
  • How much data are you backing up and what are you backing up to. We back up some 2008 servers using ShadowProtect without any problems.

    The backups write to separate internal hard drives and then robocopy to external drives and NAS. We use EventCreate to write robocopy failures to the event log which we also monitor.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: GXR
  • The amount of data varies. I have found what appears to be an issue or I have something set incorrectly. The storagecraft informational alerts that appear in the application log are not being recorded in the agent's copy of the application event log. The only events in the agent's copy are Micrsoft Related alerts.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: nenstuart
  • what version of ShadowProtect are you running? 3.5.2? Server or SBS Edition?

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: GXR
  • We reun multiple different versions depending on the system it is installed on. The issue was resolved. Turns out it was an issue with the Kaseya agent 6.0.0.1

    Had to update the agent to 6.0.0.3 in order to catch the alerts needed to satisfy the alert set.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: nenstuart
  • We are having the same issue where all servers report as missing the event ID after 24 hours, however when manually checking the event ID's exist.

    I have created a support tech with Kaseya, however all they have done to try and resolve the issue is re-apply the monitor alerts.

    Has anyone had any update on this?

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: luke.bragg
  • Thanks for that nenstuart!

    Will have to try and upgrade a few agents to test as last time we updated agents the servers we updated them on crashed.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: luke.bragg
  • ... just for completion ...

    > Error Codes from ShadowProtect

    support.storagecraft.com/.../123

  • Thanks  Kai. When I asked them about it a few years ago they didn't have any windows logs for image manager so it's great to see that has changed.