Home
»
Discussion Forums
»
Alerts - VSA
»
I Need Improper shutdown system Event id in windows xp Operating system Details
Subscribe via RSS
Share this
Similar Posts
Improper System Shutdown with Patch Management
by
LegacyPoster
on
Mar 11, 2009
Detailed list of System Recovery Event Codes!
by
LegacyPoster
on
Apr 14, 2010
Customers of 3 MSPs Shutdown by Ransomware via Kaseya, need details so we can protect our assets
by
PedroPolakoff3
on
Jun 21, 2019
Verified Answer
Windows System Events?
by
LegacyPoster
on
Feb 16, 2010
2007 time zone update for Microsoft Windows operating systems
by
LegacyPoster
on
Mar 2, 2007
View More
Details
18
Replies
0
Subscribers
Posted
over 11 years ago
Alerts - VSA
I Need Improper shutdown system Event id in windows xp Operating system Details
Posted by
LegacyPoster
on
Apr 9, 2010 3:01 PM
[QUOTE=stu_u2k;56828]Done, thanks.
Just out of Interest have you used or tried to use the Ignore filter in Event Log monitoring?
Only it turns out if you ignore say 6008 in set 1 that will actually mean 6008 is ignore in ALL SETS! Kaseya support have confirmed this for me as I logged a ticket with regard to a Symantec System Recovery monitoring problem I had, I posted it on the forum too if you want more details...
http://community.kaseya.com/xsp/f/27/t/7265.aspx
[/QUOTE]
we use the the ignore filters, We use different filters for servers, workstations, laptops eg.
We don't have the issue you are talking about. so it can probably be fixed.
Legacy Forum Name: Event Sets,
Legacy Posted By Username: Martijn Frickel
You have posted to a forum that requires a moderator to approve posts before they are publicly available.
Posted by
LegacyPoster
on
Apr 9, 2010 4:08 PM
Well according to support Ignoring in any one set will ignore all which match that config.
It all depends how specific you are really, however with System Recovery they all use Event ID:100 so it is very hard to filter properly. Don't know if you have a test machine but if you could enable your Event ID:6008 set and then create another just for the test bed with just Ignore 6008 then reset the machine do you still get a alert?
Legacy Forum Name: Event Sets,
Legacy Posted By Username: stu_u2k
You have posted to a forum that requires a moderator to approve posts before they are publicly available.
Posted by
LegacyPoster
on
Apr 9, 2010 5:08 PM
For example, on our development departments webservers i've set up an ignore list for events logged by ASP.NET making use of the combination of Source filter and description filters
I also created a list using the same source filter and other description filters to send out alerts for events that are important.
In these filters the Event ID to ignore/alert is set to All IDs
When i made use of the Event ID code (in this case 1309) in combination with the description filters it didn't work the way we want to.
(not alerting and/or ignoring everything)
Maybe this is a workaround for the issue, it seems to work just fine for us this way.
Legacy Forum Name: Event Sets,
Legacy Posted By Username: Martijn Frickel
You have posted to a forum that requires a moderator to approve posts before they are publicly available.
Posted by
LegacyPoster
on
Apr 9, 2010 7:51 PM
Yes that is fine if you can use it like that, I wanted to just past the error codes from System Recovery into one set as Ignore and another set the same codes with the same description not to ignore them, this is all because Symantec cannot provide us with a list of codes!
Ideally I wanted set one ignoring fails, this set would just email us then to advise completion.
The seconds set would instead log tickets with these events but because it is ignored in the success set it gets ignored both places.
If I have a conclusive list of codes it would not be a problem because each set would only log specifically defined events, the risk is that we miss events if we don't have a conclusive list.
Legacy Forum Name: Event Sets,
Legacy Posted By Username: stu_u2k
You have posted to a forum that requires a moderator to approve posts before they are publicly available.
<