EEM - Netflow detector using application name

Hi Guys
I'm attempting to set up a detector that fires when an application is seen.
I've set up the flow monitor
2951-HQ#sho flow monitor AppWatch cache
  Cache type:                               Normal
  Cache size:                                 4096
  Current entries:                              55
  High Watermark:                               55
  Flows added:                                 586
  Flows aged:                                  531
    - Active timeout      ( 30000 secs)          8
    - Inactive timeout    (   300 secs)        523
    - Event aged                                 0
    - Watermark aged                             0
    - Emergency aged                             0
IPV4 SRC ADDR    IPV4 DST ADDR    APP NAME                       
===============  ===============  ================================
10.66.236.61     10.66.236.218    prot icmp                      
10.66.236.243    x.x.x.x   port telnet  
But not having a lot of luck when attempting to create the detector
event manager applet AppWatch
event nf monitor-name "AppWatch" event-type create event1 entry-value "port telnet"  field application name entry-op eq
Router returns:
%EEM: Failed to register event(s) for applet AppWatch: 'Embedded Event Manager' detected the 'warning' condition 'invalid parameters'
I'm runnig c2951-universalk9-mz.SPA.152-3.T2.bin
Its probably the obvious, but I'll take any tips
cheers
Peter
(after I exit configuration

Hi Peter,
This blog may help you.  We did something similar with Flexible NetFlow Performance Monitoring. It is a two part blog and it makes use of something similar with EEM. Please vote on our posts if they help you.
Jake Wilson
NetFlow Knight

Similar Messages

  • Using Application Name twice while registering a Concurrent Program

    Hi,
    When we create a Concurrent PRogram,
    1) We first create an executable. In the executable screen, we give the name of the Application like Receivables, Payables etc.
    2) Next we Define the Concurrent program and attach the executable. Here also we give the Application Name like Receivables, Payables etc.
    Question is, when the executable already has information about the Application Name, then why do we have to give it again in the Concurrent Program Define Screen.
    Looking for a prompt response.
    Thanks
    Saurabh

    Hello Helios,
    I dont have any problem in creating a concurrent program or executable.
    I am just trying to understand the concept that why do we need to give the Application Name twice, one while Creating the Executable and one while define the Concurrent Program.
    Because if you look at the executable, we already have give the Application Name and then we attach this Execiutable to the Concurrent PRogram Defintiiion, then why again we give the Application name in the Concurrent PRogram Def Screen.
    Thanks
    Saurabh

  • I use msn internet browser and it constantly crashes with the info from event viewer: Faulting application name: msn.exe, version: 10.50.19.1000, time stamp: 0x51ddb7de this can happen numerous times in a single day help please

    Log Name:      Application
    Source:        Application Error
    Date:          2/26/2014 2:16:26 PM
    Event ID:      1000
    Task Category: (100)
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      SuperFlyXPS
    Description:
    Faulting application name: msn.exe, version: 10.50.19.1000, time stamp: 0x51ddb7de
    Faulting module name: MSHTML.dll, version: 11.0.9600.16518, time stamp: 0x52f365cb
    Exception code: 0xc0000005
    Fault offset: 0x00175363
    Faulting process id: 0x1260
    Faulting application start time: 0x01cf32a011d4aeb4
    Faulting application path: C:\Program Files (x86)\MSN\MSNCoreFiles\msn.exe
    Faulting module path: C:\Windows\system32\MSHTML.dll
    Report Id: a1704306-9f33-11e3-acde-782bcbac25e5
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Application Error" />
        <EventID Qualifiers="0">1000</EventID>
        <Level>2</Level>
        <Task>100</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-02-26T22:16:26.000000000Z" />
        <EventRecordID>80997</EventRecordID>
        <Channel>Application</Channel>
        <Computer>SuperFlyXPS</Computer>
        <Security />
      </System>
      <EventData>
        <Data>msn.exe</Data>
        <Data>10.50.19.1000</Data>
        <Data>51ddb7de</Data>
        <Data>MSHTML.dll</Data>
        <Data>11.0.9600.16518</Data>
        <Data>52f365cb</Data>
        <Data>c0000005</Data>
        <Data>00175363</Data>
        <Data>1260</Data>
        <Data>01cf32a011d4aeb4</Data>
        <Data>C:\Program Files (x86)\MSN\MSNCoreFiles\msn.exe</Data>
        <Data>C:\Windows\system32\MSHTML.dll</Data>
        <Data>a1704306-9f33-11e3-acde-782bcbac25e5</Data>
      </EventData>
    </Event>
    need help with . . .

    Hi,
    I found a useful link:
    MSN has encountered a problem needs to close or MSN is not responding Error
    https://answers.msn.com/solution.aspx?solutionid=11abae39-d906-4113-bb4e-ecfaa81798f0
    Please take a look of this part
    (Common Faulty Module on MSN
    Mshtml.dll)
    *Instead of MSN, here is a another software called Skype, just instroduce it to you, hope you can enjoy it.*
    Yolanda Zhu
    TechNet Community Support

  • The name 'rolename' is in use by the cluster already as network name or application name

    I removed windows cluster ISCSI target server few days back since it was not needed and now its needed as we need since its a clustered storage space and we need this role for ISCSI storage to external server. Now when I add the role again I get this error
    The name winiscsi is in use by the cluster already as network name or application name
    I double check role is not installed . I even rebooted both nodes
    ad

    Hi Adnan-Vohra,
    Could you post the original error information or the screenshot about this error, I can’t find out any similar error explain, we can not install the iSCSI target on any cluster
    node we need the separate server as the shared storage.
    Failover Clustering Hardware Requirements and Storage Options
    https://technet.microsoft.com/en-us/library/jj612869.aspx
    I’m glad to be of help to you!
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

  • # The Application Name that you provided has already been used.

    "# The Application Name that you provided has already been used. Please provide a unique Application Name."
    Anyone else getting this when trying to update their apps description on iTunes Connect?

    I get this error, too, and have been getting it since my app launched (about 2 weeks ago). My first email to [email protected] was met with a "We're working on it" reply, but they have been ignoring me since. Pretty frustrating.

  • BSP call using the application name created in reserved namespace

    Hi,
    Can you please help on the following.
    How to call a bsp applicaion that is  created using reseverd name space(Ex: /eee/*****) by using the bsp call tag.
    Ex: say my application name is /eee/prodlist.If i give the application in the below format it is giving me the error.even I tried giving single / also.
    <bsp:call url="..//eee/prodlist/vhelp.do">

    Hi,
    Go through the sample codes present in the below links,
    http://help.sap.com/saphelp_nw2004s/helpdata/en/9d/1ca7f91b76ad4493d62b8ecc7c83db/frameset.htm
    http://help.sap.com/saphelp_nw2004s/helpdata/en/7e/d31c3d8679e94a809d4739433c4e44/frameset.htm
    http://help.sap.com/saphelp_nw2004s/helpdata/en/d7/5a693c114bf147e10000000a11402f/frameset.htm
    Regards,
    Azaz Ali.

  • Bugreport: imported Application can't be edited because it uses " in Name

    APEX 4.2.1
    I imported an 4.0 Application into 4.2.1 which was successful. When trying to edit that Application in the Application Builder an error message is displayed saying that Application can't be edited because it uses invalid symbols like < and >.
    The Application didn't use < or > but it used double-quotes " in the Application Name.
    As Workaround i used the search box in the application builder to directly jump into edit-page (enter <app-id>-<page-id> into the search box), from there i went to application definition and removed the double-quotes. Now the application can be edited again.
    brgds,
    Peter
    get Syntax Highlighting for the Application Builder: http://apex.oracle.com/pls/apex/f?p=APEX_DEVELOPER_ADDON:ABOUT:0:::::
    +Blog: http://www.oracle-and-apex.com+
    +ApexLib: http://apexlib.oracleapex.info+
    +BuilderPlugin: http://builderplugin.oracleapex.info+
    +Work: http://www.click-click.at and http://www.wirsindapex.at+
    +Fantastic Plugins for APEX: http://www.tryfoexnow.com+

    But if you're creating a commercial app, that's not going to inspire confidence in customers. Has anyone been through the process of using an Apple ID to configure an AIR installer so it doesn't come up with this message? It thought I was finally getting close to being set when I invested in the certificate to avoid a similar message in Windows. Now I need to understand how to sign the app so customers don't think I'm some rogue developer by encouraging them to shortcut their security settings. Any suggestions would be greatly appreciated.

  • SSO Deployment-specific login - howto display application name

    I am deploying 4 forms applications using a single SSO server/OID for authentication. The problem is, I want to display the application name on login.jsp, depending on which application was requested.
    For example:
    If the URL is http://localhost/forms/frmservlet?config=app1, then login.jsp should display "App1".
    If the URL is http://localhost/forms/frmservlet?config=app2, then login.jsp should display "App2".
    ...... and so on. Has anyone ever done it before? I am using Oracle 10g Release 2.
    Thanks,
    Sanjay Gulabani

    Thanks to timktaylor's earlier post (messageid=1184036), I was able to solve this problem. I am using Oracle 10g (10.1.2.0.2) Single Sign On and Forms Services.
    For anyone who is facing a similar problem, I am pasting the code - just use it as it is in login.jsp - of course, you will need to change app1 and "APP 1" etc to suit your application names.
    (%ORACLE_HOME%\j2ee\OC4J_SECURITY\applications\sso\web\jsp\login.jsp):
    <%
    String str_token = null;
    try
    str_token = request.getParameterValues("site2pstoretoken")[0];
    catch (Exception e)
    try
    str_token = request.getParameterValues("Site2pstoreToken")[0];
    catch (Exception e1)
    str_token = null;
    if(str_token == null)
    throw new Exception("The site2pstoretoken value not found");
    //Code to decode site2pstoretoken starts here
    java.sql.Connection con = null;
    try
    oracle.jdbc.pool.OracleDataSource ds = new oracle.jdbc.pool.OracleDataSource();
    ds.setURL("jdbc:oracle:thin:@ngt-hyd:1521:orcl");
    con = ds.getConnection("orasso", "UBrWt0c9" );
    java.lang.String query = "begin ? := wwsso_utl.unbake_site2pstore_token('" + str_token + "',?); end;";
    java.sql.CallableStatement cstmt = con.prepareCall(query);
    cstmt.registerOutParameter(1, java.sql.Types.VARCHAR);
    cstmt.registerOutParameter(2, java.sql.Types.VARCHAR);
    cstmt.executeQuery();
    java.lang.String x = cstmt.getString(1);
    if (x.toLowerCase().indexOf("config%3dapp1") > -1) ngd_app_name = "APP 1";
    if (x.toLowerCase().indexOf("config%3dapp2") > -1) ngd_app_name = "APP 2";
    if (x.toLowerCase().indexOf("config%3dapp3") > -1) ngd_app_name = "APP 3";
    if (x.toLowerCase().indexOf("config%3dapp4") > -1) ngd_app_name = "APP 4";
    if (x.toLowerCase().indexOf("oiddas") > -1) ngd_app_name = "Delegated Administrative Services";
    javax.servlet.http.HttpSession session = request.getSession();
    if (ngd_app_name.trim().length() > 0) session.setAttribute("ngd_app_name",ngd_app_name);
    out.println("<center>");
    out.println(ngd_app_name);
    out.println("</center>");
    finally
    if( con != null ) { con.close(); }
    //Code to decode site2pstoretoken ends here
    %>

  • How to get application name from a receive location?

    Hi all,
    I am trying to do a custom error application, and I want to notify system admin users that "the receive port XXXX has stopped in application YYYYYY".
    Right now I do know which receive location that is being suspended. But I am not being able to get the application name, associated to this receive location (I can also get the ReceivePort, if it matters).
    I've tried 2 ways:
    > using WMI
    > Using SQL (direct query in BizTalk databases - for testing).
    I did not found any solution, even search table by table, i did not found a relation between Applications and receive location..
    Anyone? 
    Thanks in advance
    Ricardo Bessa

    The following SQL query should give you a result of every disabled receive location as well as it's receive port and application:
    SELECT
    RL.Name AS ReceiveLocationName
    , RP.nvcName AS ReceivePortName
    , APP.nvcName As Application
    FROM [BizTalkMgmtDb].[dbo].[adm_ReceiveLocation] AS RL WITH(NOLOCK)
    INNER JOIN [BizTalkMgmtDb].[dbo].[bts_receiveport] AS RP WITH(NOLOCK)
    ON RL.ReceivePortId = RP.nID
    INNER JOIN [BizTalkMgmtDb].[dbo].[bts_application] AS APP WITH(NOLOCK)
    ON RP.nApplicationID = APP.nID
    WHERE
    RL.[Disabled] = -1
    ORDER BY Application ASC
    Christian @ IntegrationAdmin.com

  • How To Remove A Specific Application Name From The "Open With" Dialog

    When you right click on a file you are presented with the "Open With" menu item and you are also presented with a list of applications that could potentially be used to open that file.
    In my case, when I click on a file of type .mov I am presented with the name of an application that I want to remove from the list, because that application ( Miro.app (2.5.2) ) no longer exists on my system.
    What is the best way to remove that application name from the list?

    Ok, but how does one remove some of the applications that are appear in the context menu for a given file type? Is there an asc file which can be edited?
    For example, in my system a PDF can be opened with over 10 applications. I would like to see just the three ones I use: Acrobat, Skim and Preview.
    Thanks in advance.

  • How to find the list of un used table names in a schema?

    Hi,
    I have a doubt in Oracle. The doubt is that If we are using any tables in Function Or Proc.... Then...We can list all those used table names from USER_DEPENDENCIES system table. Right...
    But, If the table is used with Execute Immediate Statement, then, those table names are not coming out with USER_DEPENDENCIES system table. Because they are identified at run time and not compile time.
    It is fine. And I agree.. But, If I want to list out those tables also...then...How to do? Any idea?
    I think ‘USER_SOURCE’ system table may not be the right one. If there is any other system table avails for this purpose...then..it would be very grateful to extract right...
    So I am wanting that exact system table.
    Please let me know about this, if you have any idea or check with your friends if they have any idea.
    Regards,
    Subramanian G

    Hi Guys,
    Thanks for all your answers.
    Yes....You are all right. We can list out the used tables upto certain extent. Anyhow, I have done some R&D to derive the SQL's which is given below:
    SELECT TABLE_NAME FROM USER_TABLES
    MINUS
    SELECT DISTINCT UPPER(REFERENCED_NAME)
    FROM user_dependencies
    where
    referenced_type='TABLE' and UPPER(NAME) in
    select distinct UPPER(object_name) from user_objects where UPPER(object_type) in
    'MATERIALIZED VIEW',
    'PACKAGE',
    'PACKAGE BODY',
    'PROCEDURE',
    'TRIGGER',
    'VIEW',
    'FUNCTION'
    UNION
    SELECT UT.TABLE_NAME FROM
    SELECT TABLE_NAME FROM USER_TABLES
    MINUS
    SELECT DISTINCT UPPER(REFERENCED_NAME)
    FROM user_dependencies
    where
    referenced_type='TABLE' and UPPER(NAME) in
    select distinct UPPER(object_name) from user_objects where UPPER(object_type) in
    'MATERIALIZED VIEW',
    'PACKAGE',
    'PACKAGE BODY',
    'PROCEDURE',
    'TRIGGER',
    'VIEW',
    'FUNCTION'
    AND REFERENCED_OWNER=(SELECT sys_context('USERENV', 'CURRENT_SCHEMA') FROM dual)
    ) UT,
    ( SELECT * FROM USER_SOURCE
    WHERE NAME IN
    ( SELECT DISTINCT NAME FROM USER_SOURCE
    WHERE TYPE NOT IN ('TYPE')
    AND
    UPPER(TEXT) LIKE '%EXECUTE IMMEDIATE%'
    ) US
    WHERE
    UPPER(US.TEXT) LIKE '%'||UPPER(UT.TABLE_NAME)||'%'
    AND
    (UPPER(US.TEXT) NOT LIKE '%--%')
    The above SQL Query can list out unused tables by checking the Dynamic SQL Statement also upto some level only.
    Once we extracted the list of unused tables, having a manual check would be also greater to verify as it is should not impact the business applications.
    Regards,
    Subramanian G

  • BADI for changing Appraisal document application name for Web dynpro ABAP

    Hi,
    For Appraisal document customizing through PHAP_CATALOG_PA, We have BADI HRHAP00_BSP_TMPL  to change the BSP application name which can be used in Web layout for output display. Using this we can change application name from HAP_DOCUMENT to custom BSP application name
    Similarly, what is the BADI for changing Web dynpro ABAP applictaion name? Currently its triggering HAP_MAIN_DOCUMENT.
    how do we change application name to some custom web dynpro application name
    Regards,
    Kothand

    Hi Karim,
    I don't know, if there is any chance to get the Webdynpro application name. At least in the ABAP System fields is no information about the webdynpro application name.
    One remark: I have allways problems with BAPIS / BADIS that behave different depending on the caller. Could it be a good idea to pass some information through the interface / parameters?
    Best regards
    Renald

  • How to get Application name of a current running process in LiveCycle??

    Hi,
    I want to get the Application name of current running process in LiveCycle as a output value.
    I have 3 applictions, the 3 applications are calling same SubProcess, so I want get the name of the application from which the sub process has been called.
    I want to retrieve the Application name and asssign this value to a output variable.
    I have searched for the solution I found a method getApplicationName() but inorder to get the current running process's Application Name this might not be useful..
    So suggest the way to resolve this..
    Thanks in Advance.....
    Regards,
    Kalyan Urimi

    Use an input/output string variable in the subprocess and set its value in each calling process as respective Application name.
    May be if this could help.
    Thanks,
    Wasil

  • My itunes wount open when i try to open it this message comes up Problem signature:   Problem Event Name:     BEX   Application Name:     iTunes.exe   Application Version:     10.6.3.25   Application Timestamp:     4fd16377   Fault Module Name:     CRYPTU

    when i try to open my Itunes this Message comes up
    Problem signature:
      Problem Event Name:    BEX
      Application Name:    iTunes.exe
      Application Version:    10.6.3.25
      Application Timestamp:    4fd16377
      Fault Module Name:    CRYPTUI.dll_unloaded
      Fault Module Version:    0.0.0.0
      Fault Module Timestamp:    4ce7b847
      Exception Offset:    68221040
      Exception Code:    c0000005
      Exception Data:    00000008
      OS Version:    6.1.7601.2.1.0.768.3
      Locale ID:    5129
      Additional Information 1:    0a9e
      Additional Information 2:    0a9e372d3b4ad19135b953a78882e789
      Additional Information 3:    0a9e
      Additional Information 4:    0a9e372d3b4ad19135b953a78882e789
    Read our privacy statement online:
      http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409
    If the online privacy statement is not available, please read our privacy statement offline:
      C:\Windows\system32\en-US\erofflps.txt

    Taken at face value, you're having trouble with a Windows operating system file there.
    Perhaps try an sfc /scannow. For instructions, see the following Microsoft document:
    How to use the System File Checker tool to troubleshoot missing or corrupted system files on Windows Vista or on Windows 7

  • I can't open firefox. These are the problem details. Problem Event Name: APPCRASH Application Name: firefox.exe Application Version: 23.0.1.4974 Appli

    Problem Event Name: APPCRASH
    Application Name: firefox.exe
    Application Version: 23.0.1.4974
    Application Timestamp: 520bc252
    Fault Module Name: ntdll.dll
    Fault Module Version: 6.0.6002.18881
    Fault Module Timestamp: 51da3e27
    Exception Code: c0000005
    Exception Offset: 00066448
    OS Version: 6.0.6002.2.2.0.768.3
    Locale ID: 2057
    Additional Information 1: bfef
    Additional Information 2: e8adce1c2b9e7be834b4063ac3c53863
    Additional Information 3: bfef
    Additional Information 4: e8adce1c2b9e7be834b4063ac3c53863
    Read our privacy statement:
    http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x0409

    Try to disable hardware acceleration in Firefox.
    *Tools > Options > Advanced > General > Browsing: "Use hardware acceleration when available"
    If it works in Safe Mode and in normal mode with all extensions (Firefox/Tools > Add-ons > Extensions) disabled then try to find which extension is causing it by enabling one extension at a time until the problem reappears.
    Close and restart Firefox after each change via "Firefox > Exit" (Windows: Firefox/File > Exit; Mac: Firefox > Quit Firefox; Linux: Firefox/File > Quit)
    *https://support.mozilla.org/kb/Troubleshooting+extensions+and+themes
    https://support.mozilla.org/kb/upgrade-graphics-drivers-use-hardware-acceleration

Maybe you are looking for