[QUOTE=stu_u2k;56828]Done, thanks.



Just out of Interest have you used or tried to use the Ignore filter in Event Log monitoring?



Only it turns out if you ignore say 6008 in set 1 that will actually mean 6008 is ignore in ALL SETS! Kaseya support have confirmed this for me as I logged a ticket with regard to a Symantec System Recovery monitoring problem I had, I posted it on the forum too if you want more details...

http://community.kaseya.com/xsp/f/27/t/7265.aspx[/QUOTE]



we use the the ignore filters, We use different filters for servers, workstations, laptops eg.



We don't have the issue you are talking about. so it can probably be fixed.

Legacy Forum Name: Event Sets,
Legacy Posted By Username: Martijn Frickel

Well according to support Ignoring in any one set will ignore all which match that config.

It all depends how specific you are really, however with System Recovery they all use Event ID:100 so it is very hard to filter properly. Don't know if you have a test machine but if you could enable your Event ID:6008 set and then create another just for the test bed with just Ignore 6008 then reset the machine do you still get a alert?

Legacy Forum Name: Event Sets,
Legacy Posted By Username: stu_u2k

For example, on our development departments webservers i've set up an ignore list for events logged by ASP.NET making use of the combination of Source filter and description filters

I also created a list using the same source filter and other description filters to send out alerts for events that are important.

In these filters the Event ID to ignore/alert is set to All IDs
When i made use of the Event ID code (in this case 1309) in combination with the description filters it didn't work the way we want to.
(not alerting and/or ignoring everything)

Maybe this is a workaround for the issue, it seems to work just fine for us this way.

Legacy Forum Name: Event Sets,
Legacy Posted By Username: Martijn Frickel

Yes that is fine if you can use it like that, I wanted to just past the error codes from System Recovery into one set as Ignore and another set the same codes with the same description not to ignore them, this is all because Symantec cannot provide us with a list of codes!

Ideally I wanted set one ignoring fails, this set would just email us then to advise completion.

The seconds set would instead log tickets with these events but because it is ignored in the success set it gets ignored both places.

If I have a conclusive list of codes it would not be a problem because each set would only log specifically defined events, the risk is that we miss events if we don't have a conclusive list.

Legacy Forum Name: Event Sets,
Legacy Posted By Username: stu_u2k