Kaseya Community

Ignored Events not being ignored after 2008 upgrade

  • Is anyone else having an issue with events set to ignore being alerted on anyway. I collect all error events from both system/application. I then apply an ignore list. I am stil getting alerts for them.

    Also, can anyone confirm that an ignore entry "trumps" a collect entry? For example, if I have an ignore list with MSExchange* ignored and I then apply an Exchange Event set to collect MSExchange*, will it still be ignored? Can I use the same ignore list for all servers and then add role specific event sets that will collect, or do I have to setup seperate ignore lists for different server roles.

    Legacy Forum Name: Ignored Events not being ignored after 2008 upgrade,
    Legacy Posted By Username: WayneL@P-Connect.com
  • [QUOTE=WayneL@P-Connect.com;27777]Is anyone else having an issue with events set to ignore being alerted on anyway. I collect all error events from both system/application. I then apply an ignore list. I am stil getting alerts for them.

    Also, can anyone confirm that an ignore entry "trumps" a collect entry? For example, if I have an ignore list with MSExchange* ignored and I then apply an Exchange Event set to collect MSExchange*, will it still be ignored? Can I use the same ignore list for all servers and then add role specific event sets that will collect, or do I have to setup seperate ignore lists for different server roles.[/QUOTE]

    Yes, an Order of Operations for the precedence of event sets would be very useful. Is this information in the KnowledgeBase, Kaseya?

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: RCS-Michael
  • We were having the same issue. However, everything started working correctly after the big "Alarms Hotfix" a few days back. This is what I got from Kaseya before I knew it was working correctly:

    "On the machine you are seeing the problem. Clear the applied alerts and re-apply them. The set must be the last one in the assignment for that specific event log type."



    I also did a small test regarding the order of operations. I set security event id 675 to be ignored. I then created another set to alarm on event id 675.

    With the alarm set applied first and the ignore set applied last, I received the alarm for the event.

    With the ignore set applied first and the alarm set applied last, I did not receive the alarm.


    So based on what I saw, it matches the list from top to bottom as they are displayed. It takes action on the first item it matches and does not go any further. Also, regarding the "All Events" event set, it seems to be applied to the end no matter when you apply it. It would be helpful if we could rearrange these without having to remove/reapply event sets.

    In order from top to bottom it should be specific alarm sets first, then your ignore sets, and then the All Events.


    Steve

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: SteveR
  • We also experience this issue, no response from Kaseya support, ticket opened, phone calls made (on hold for hours). I have searched through the forums and the Knowledge Base.

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: chrisd
  • I just did a boot camp last week and we discussed event sets. They said that apply the Catch everything first and then apply the specifics. Apparently if you are looking at the list of the events it applies then from top to bottom. so last in first to run. So if your ignore list is at the top it will see that first then ignore the events and move on.

    Thats what I was told by the powers in kaseya.

    Michael

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: mmartin
  • I had the same problem and after some trial and error I figured this out the hard way.

    Anyways it seems to work the way Kaseya said it did in your bootcamp.

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: jasonb
  • michael.martin@itfocus.ie
    They said that apply the Catch everything first and then apply the specifics.


    On our Boot Camp the order we were told was as follows:

    1. Specifics - various lists of filters with specific events to catch
    2. Filter - list of events to ignore
    3. Catch all as the final addition

    This makes a lot more sense as they seem to process in order.

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: jor@qualcom.ie
  • Doesn't work for me. Kaseya appears to order the event sets as it pleases, not matter which order I apply the event sets.

    Also, adding more events to the "ignore events" event set doesn't appear to be applied to the machines to which the event set is applied. I have tried using the "deploy" button, re-applying the settings for the event set, force an update of the agent, but nothing works. Certain events in the "ignore events" event set is still generating alarms and e-mails.

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: Lmhansen
  • Lmhansen
    I have tried using the "deploy" button, re-applying the settings for the event set, force an update of the agent, but nothing works. Certain events in the "ignore events" event set is still generating alarms and e-mails.


    Yeah, the "deploy" button seems to be window dressing mostly. When I add more event IDs to the event set, although it is excruciatingly painstaking, I do tend to clear all monitoring from every agent and re-apply from scratch. This seems to be the only way to get this to work.

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: jor@qualcom.ie
  • I just don't have the time to keep re-adding the events sets whenever changes are made. This is something that *must* be fixed. It worked in the previous version (to the best of my recollection), so it should work here...

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: Lmhansen
  • Can you post a ticket number?

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: Jeff.Keyes
  • Who should post ticket number?

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: Lmhansen
  • jor@qualcom.ie
    Yeah, the "deploy" button seems to be window dressing mostly.


    Time for some hat eating. I tried this again today and it does seem to have worked (from the server end at least).

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: jor@qualcom.ie
  • Lmhansen
    I just don't have the time to keep re-adding the events sets whenever changes are made. This is something that *must* be fixed. It worked in the previous version (to the best of my recollection), so it should work here...


    Have you tried doing the Hotfix that is supposed to address event set problems? That may help in your case. Also, I do agree that there has to be an easier way of working with the event sets in Kaseya. Maybe it will get some attention in one of the next release.

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: cking@faylib.org