SSCM Reporting/Alerting Functions - Event Logs?

Good Evening:
I am trying to get some clarification on some functionality of SCCM in regards to alerting and what the client can do and or scrape on the client.
For example, I want to be able to generate an alert based on an event in the system logs of a client OS, if a particular log item has been generated.  Should I be using queries to achieve this (if possible)?  If so can someone guide me to some documentation.
Also I found some information on determining USB detection, which is great.  I would like to use this as well, and generate these items via an email or report with subscription.  Should I be using the asset intelligence for this piece?
Sorry for the vague questions, I really found no concrete information via 4 hours of google searching :(
Any help would be great.

For example, I want to be able to generate an alert based on an event in the system logs of a client OS, if a particular log item has been generated.  Should I be using queries to achieve this (if possible)?  If so can someone guide me to some
documentation.
This sounds more like an OpsMgr task.
USB detection? ConfigMgr can detect USB devices using hardware inventory, but that's about it.
Torsten Meringer | http://www.mssccmfaq.de

Similar Messages

  • Vista got corrupt after power failure. sfc reports error and Event log service is unable to start itself.

    Hi,
    After a sudden power failure, I guess vista file system is corrupt.   I am able to start vista in normal mode, but it seems there are errors like Event Log service unable to start itself,  when I start IE, it closes automatically , 
    Norton antivirus does not start itself.  and so on.
    After Bing search, I went to safe mode and executed sfc /scannow and it reported error as below.
    "Windows resource protection found corrupt files but was unable to fix some of them"
    Unfortunately I am unable to upload log file, so I am pasting CBS.log content here....   Please advice.
    Some parts of logs are removed due to limit of 60000 characters.
    Please advice.
    Regards
    2014-07-07 14:55:57, Info                  CBS    Loaded Servicing Stack v6.0.6002.18005 with Core: C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.0.6002.18005_none_0b4ada54c46c45b0\cbscore.dll
    2014-07-07 14:55:58, Info                  CSI   
    00000001@2014/7/7:09:25:58.062 WcpInitialize (wcp.dll version 0.0.0.5) called (stack @0x6e9c8a50 @0x7147854e @0x714563a1 @0x341392 @0x341ed4 @0x3417cb)
    2014-07-07 14:55:58, Info                  CSI   
    00000002@2014/7/7:09:25:58.156 WcpInitialize (wcp.dll version 0.0.0.5) called (stack @0x6e9c8a50 @0x714ae7b6 @0x71490f93 @0x341392 @0x341ed4 @0x3417cb)
    2014-07-07 14:55:58, Info                  CSI   
    00000003@2014/7/7:09:25:58.187 WcpInitialize (wcp.dll version 0.0.0.5) called (stack @0x6e9c8a50 @0x73981a0d @0x73981794 @0x34360b @0x342be3 @0x3417cb)
    2014-07-07 14:55:58, Info                  CBS    NonStart: Checking to ensure startup processing was not required.
    2014-07-07 14:55:58, Info                  CBS    NonStart: Windows is in Safe Mode.
    2014-07-07 14:55:58, Info                  CSI    00000004 IAdvancedInstallerAwareStore_ResolvePendingTransactions (call 1) (flags = 00000004, progress = NULL,
    phase = 0, pdwDisposition = @0x2dfe70
    2014-07-07 14:55:58, Info                  CBS    NonStart: Success, startup processing not required as expected.
    2014-07-07 14:55:58, Info                  CSI    00000005 CSI Store 4780952 (0x0048f398) initialized
    2014-07-07 14:56:03, Info                  CSI    00000006 [SR] Verifying 100 (0x00000064) components
    2014-07-07 14:56:03, Info                  CSI    00000007 [SR] Beginning Verify and Repair transaction
    2014-07-07 14:56:10, Info                  CSI    00000008 Repair results created:
    POQ 0 starts:
         0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\ca20037dc599cf01650000007806a403._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
        1: Move File: Source = [l:218{109}]"\SystemRoot\WinSxS\Temp\PendingRenames\aa070f7dc599cf01660000007806a403.program_files_ffd0cbfc813cc4f1.cdf-ms", Destination = [l:130{65}]"\SystemRoot\WinSxS\FileMaps\program_files_ffd0cbfc813cc4f1.cdf-ms"
        2: Move File: Source = [l:244{122}]"\SystemRoot\WinSxS\Temp\PendingRenames\6aca137dc599cf01670000007806a403.program_files_common_files_d7a65bb2f0e854e7.cdf-ms", Destination = [l:156{78}]"\SystemRoot\WinSxS\FileMaps\program_files_common_files_d7a65bb2f0e854e7.cdf-ms"
        3: Move File: Source = [l:278{139}]"\SystemRoot\WinSxS\Temp\PendingRenames\2a8d187dc599cf01680000007806a403.program_files_common_files_microsoft_shared_818c5a0e45020fba.cdf-ms", Destination = [l:190{95}]"\SystemRoot\WinSxS\FileMaps\program_files_common_files_microsoft_shared_818c5a0e45020fba.cdf-ms"
        4: Move File: Source = [l:286{143}]"\SystemRoot\WinSxS\Temp\PendingRenames\4ab11f7dc599cf01690000007806a403.program_files_common_files_microsoft_shared_ink_3c86e3db0b3b254c.cdf-ms", Destination = [l:198{99}]"\SystemRoot\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_3c86e3db0b3b254c.cdf-ms"
        5: Move File: Source = [l:292{146}]"\SystemRoot\WinSxS\Temp\PendingRenames\aa12227dc599cf016a0000007806a403.program_files_common_files_microsoft_shared_ink_en_7a951cedcb9a5105.cdf-ms", Destination = [l:204{102}]"\SystemRoot\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_en_7a951cedcb9a5105.cdf-ms"
        6: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\aa28487dc599cf016b0000007806a403.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms"
        7: Move File: Source = [l:208{104}]"\SystemRoot\WinSxS\Temp\PendingRenames\6aeb4c7dc599cf016c0000007806a403.$$_ehome_40103e2da1d
    2014-07-07 14:56:10, Info                  CSI    121de.cdf-ms", Destination = [l:120{60}]"\SystemRoot\WinSxS\FileMaps\$$_ehome_40103e2da1d121de.cdf-ms"
    POQ 0 ends.
    2014-07-07 14:56:10, Info                  CSI    00000009 [SR] Verify complete
    2014-07-07 14:56:11, Info                  CSI    0000000a [SR] Verifying 100 (0x00000064) components
    2014-07-07 14:56:11, Info                  CSI    0000000b [SR] Beginning Verify and Repair transaction
    2014-07-07 14:56:19, Info                  CSI    0000000c Repair results created:
    POQ 1 starts:
    POQ 42 ends.
    2014-07-07 14:58:29, Info                  CSI    000000b1 [SR] Verify complete
    2014-07-07 14:58:30, Info                  CSI    000000b2 [SR] Verifying 100 (0x00000064) components
    2014-07-07 14:58:30, Info                  CSI    000000b3 [SR] Beginning Verify and Repair transaction
    2014-07-07 14:58:38, Info                  CSI    000000b4 Repair results created:
    POQ 43 starts:
         0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\4a5ad3d4c599cf01391100007806a403._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
        1: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\4a5ad3d4c599cf013a1100007806a403.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms"
        2: Move File: Source = [l:234{117}]"\SystemRoot\WinSxS\Temp\PendingRenames\cadfdcd4c599cf013b1100007806a403.$$_help_windows_en-us_b594929e73669c5e.cdf-ms", Destination = [l:146{73}]"\SystemRoot\WinSxS\FileMaps\$$_help_windows_en-us_b594929e73669c5e.cdf-ms"
        3: Move File: Source = [l:228{114}]"\SystemRoot\WinSxS\Temp\PendingRenames\2a41dfd4c599cf013c1100007806a403.$$_help_help_en-us_91e6e7979a9bf9c6.cdf-ms", Destination = [l:140{70}]"\SystemRoot\WinSxS\FileMaps\$$_help_help_en-us_91e6e7979a9bf9c6.cdf-ms"
        4: Move File: Source = [l:214{107}]"\SystemRoot\WinSxS\Temp\PendingRenames\ea0ef7d4c599cf013d1100007806a403.$$_apppatch_1143992cbbbebcab.cdf-ms", Destination = [l:126{63}]"\SystemRoot\WinSxS\FileMaps\$$_apppatch_1143992cbbbebcab.cdf-ms"
        5: Move File: Source = [l:218{109}]"\SystemRoot\WinSxS\Temp\PendingRenames\ea241dd5c599cf013e1100007806a403.program_files_ffd0cbfc813cc4f1.cdf-ms", Destination = [l:130{65}]"\SystemRoot\WinSxS\FileMaps\program_files_ffd0cbfc813cc4f1.cdf-ms"
        6: Create Directory: Directory = [l:48{24}]"\??\C:\Program Files\MSN", Attributes = 00000080
    POQ 43 ends.
    2014-07-07 14:58:38, Info                  CSI    000000b5 [SR] Verify complete
    2014-07-07 14:58:38, Info                  CSI    000000b6 [SR] Verifying 100 (0x00000064) components
    2014-07-07 14:58:38, Info                  CSI    000000b7 [SR] Beginning Verify and Repair transaction
    2014-07-07 14:58:43, Info                  CSI    000000b8 Repair results created:
    POQ 44 starts:
         0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\eac6f0d7c599cf01a31100007806a403._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
        1: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\aa89f5d7c599cf01a41100007806a403.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms"
        2: Move File: Source = [l:216{108}]"\SystemRoot\WinSxS\Temp\PendingRenames\6a4cfad7c599cf01a51100007806a403.$$_resources_fbee56ab048ab239.cdf-ms", Destination = [l:128{64}]"\SystemRoot\WinSxS\FileMaps\$$_resources_fbee56ab048ab239.cdf-ms"
        3: Move File: Source = [l:230{115}]"\SystemRoot\WinSxS\Temp\PendingRenames\caadfcd7c599cf01a61100007806a403.$$_resources_themes_4d0d4910e83c2273.cdf-ms", Destination = [l:142{71}]"\SystemRoot\WinSxS\FileMaps\$$_resources_themes_4d0d4910e83c2273.cdf-ms"
        4: Move File: Source = [l:240{120}]"\SystemRoot\WinSxS\Temp\PendingRenames\caadfcd7c599cf01a71100007806a403.$$_resources_themes_aero_3fd78bf4cb5fa2c4.cdf-ms", Destination = [l:152{76}]"\SystemRoot\WinSxS\FileMaps\$$_resources_themes_aero_3fd78bf4cb5fa2c4.cdf-ms"
        5: Move File: Source = [l:252{126}]"\SystemRoot\WinSxS\Temp\PendingRenames\8a7001d8c599cf01a81100007806a403.$$_resources_themes_aero_shell_a91dfa5124b343c4.cdf-ms", Destination = [l:164{82}]"\SystemRoot\WinSxS\FileMaps\$$_resources_themes_aero_shell_a91dfa5124b343c4.cdf-ms"
        6: Move File: Source = [l:276{138}]"\SystemRoot\WinSxS\Temp\PendingRenames\aa9408d8c599cf01a91100007806a403.$$_resources_themes_aero_shell_normalcolor_10be8ec981b35fb6.cdf-ms", Destination = [l:188{94}]"\SystemRoot\WinSxS\FileMaps\$$_resources_themes_aero_shell_normalcolor_10be8ec981b35fb6.cdf-ms"
        7: Move File: Source = [l:214{107}]"\SystemRoot\WinSxS\Temp\PendingRenames\cab80fd8c599cf01aa1100007806a403.$$_schcache_f995a5d4decb8cc0.cdf-ms", Destination = [l:126{63}]"\SystemRoot\WinSxS\FileMaps\$$_schcache_f995a5d4decb8cc0.cdf
    2014-07-07 14:58:43, Info                  CSI    -ms"
        8: Move File: Source = [l:212{106}]"\SystemRoot\WinSxS\Temp\PendingRenames\cad948d8c599cf01ab1100007806a403.$$_msagent_be90584645cb9b95.cdf-ms", Destination = [l:124{62}]"\SystemRoot\WinSxS\FileMaps\$$_msagent_be90584645cb9b95.cdf-ms"
        9: Move File: Source = [l:214{107}]"\SystemRoot\WinSxS\Temp\PendingRenames\4a7578d8c599cf01ac1100007806a403.$$_system32_21f9a9c4a2f8b514.cdf-ms", Destination = [l:126{63}]"\SystemRoot\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms"
        10: Move File: Source = [l:242{121}]"\SystemRoot\WinSxS\Temp\PendingRenames\cafa81d8c599cf01ad1100007806a403.$$_system32_manifeststore_7d35b12f9be4c20e.cdf-ms", Destination = [l:154{77}]"\SystemRoot\WinSxS\FileMaps\$$_system32_manifeststore_7d35b12f9be4c20e.cdf-ms"
        11: Move File: Source = [l:224{112}]"\SystemRoot\WinSxS\Temp\PendingRenames\aae18dd8c599cf01ae1100007806a403.$$_msagent_chars_9a5bcb5da392f588.cdf-ms", Destination = [l:136{68}]"\SystemRoot\WinSxS\FileMaps\$$_msagent_chars_9a5bcb5da392f588.cdf-ms"
    POQ 107 ends.
    2014-07-07 15:08:01, Info                  CSI    00000213 [SR] Repair complete
    2014-07-07 15:08:01, Info                  CSI    00000214 [SR] Committing transaction
    2014-07-07 15:08:01, Info                  CSI    00000215 Creating NT transaction (seq 1), objectname [6]"(null)"
    2014-07-07 15:08:01, Info                  CSI    00000216 Created NT transaction (seq 1) result 0x00000000, handle @0x4cc
    2014-07-07 15:08:01, Info                  CSI   
    00000217@2014/7/7:09:38:01.060 CSI perf trace:
    CSIPERF:TXCOMMIT;5
    2014-07-07 15:08:01, Info                  CSI    00000218 [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction 
    have been successfully repaired
    2014-07-07 15:15:58, Info                  CBS    Scavenge: Package store indicates there is no component to scavenge, skipping.
    

    Hi,
    First, I would suggest you using last known good configuration:
    Using Last Known Good Configuration
    http://windows.microsoft.com/en-in/windows/using-last-known-good-configuration#1TC=windows-vista
    if this cannot bring your Windows Vista back to good state, I suggest you perform in-place upgrade to fix the corrupted files:
    How to Perform an In-Place Upgrade on Windows Vista, Windows 7, Windows Server 2008 & Windows Server 2008 R2
    http://support.microsoft.com/kb/2255099/en-us
    If you have any feedback on our support, please click
    here
    Alex Zhao
    TechNet Community Support

  • Crystal Reports Error in Event Log

    Hi all,
    I have an error in my events Logs on my Windows server 2003 Server. The Event ID is 4353 and the descirption is : "Either the keycode registry entry does not exist, or the process does not have sufficient permissions to read the keycode.'
    I use CR XI.
    Since I Have this error message I Can't load my reports.
    Any ideas about this case?
    Thanks in advance.
    Xavier.

    Thanks Graham but I don't have this key in the regitry.
    In fact, I only use CrystalReports11_NET_EmbeddedInstall.msi to install Crystal Reports DLL.
    Any ideas?
    Thank you.
    Xavier.

  • Change reporting destination of event logs

    Hi ,
    I need to change destination of event logs. For example there is a event log xyz in application logs i want that log to report to system logs. Is it possible? 
    \m/

    Simple answer - No.
    Please read about how Event logs work.  You will see that events are targeted by the application and you can only change that by changing the application.  THe System log is owned by the system.  You cannot change that.
    ¯\_(ツ)_/¯

  • WMIPRVSE.EXE (WMI) warning alerts in Event Logs

    Hi To all. I have one major problem one of my supported Window Server 2008 R2 SP2. I see that  in event logs randomly appears warning message :"Windows Management Instrumentation has stopped WMIPRVSE.EXE because a quota reached a warning
    value. Quota: HandleCount  Value: 4099 Maximum value: 4096 WMIPRVSE PID: 4268"
    Looked for this topics and KB :
    http://support.microsoft.com/default.aspx?scid=kb;EN-US;958124
    http://support.microsoft.com/default.aspx?scid=kb;EN-US;954563
    With no result. Any ideas about how to resolve this issue.
    Thanks!

    Hi Olegmg,
    When a quota has been exceeded, there is no specific action required other than reducing the scope or number of operations requested of the provider hosted in the WMIPRVSE process. Event ID 5612 lists the PID of the WMIPRVSE
    process that hosted the provider that exceeded the quota.
    http://technet.microsoft.com/en-us/library/dd363619(v=ws.10).aspx
    Regards.
    Vivian Wang

  • OpsMgr EventId 26007 on Domain Controllers "The EventLog service reported that the Security event log on computer ' ' is corrupt."

    Hi,
    We are receiving several eventids '26007' from the OpsMgr log on our Domain Controllers, also eventids '26008' with similar description are logged
    The EventLog service reported that the Security event log on computer '<Domain Controller Computer>' is corrupt. The Windows Event Log Provider will attempt to recover by re-opening log.
    I'll appreciate any suggestion in order to solve this issue.
    Regards.

    I guess this issue is caused by event ID 4661 is corrupted in security event log.
    Please check if you have many 4661 events in security event log and XML view cannot be viewed.
    Running the below command on DC will disable the auditing of the SAM Object access. This should stop the Event ID 4661 from being logged which should stop the Alert regarding corrupt Event log:
    auditpol /set /subcategory:"SAM" /success:disable /failure:disable
    Regards,

  • Reporting Services not automatically starting. System event log 7009, Application event: 18456

    For the past month (since Oct 11,2012)  reporting services (SSRS 2008R2) is not starting after the server is rebooted. The service is set to automatically start and starts manually without a problem.  The system event log contains the following error:
    Event ID 7009: A timeout was reached (30000 milliseconds) while waiting for the SQL Server Reporting Services (MSSQLSERVER) service to connect.
    SQL logs :
    The SQL logs has many "Event 18456 Login Failed, State 38" errors when the database engine starts. I assume clients conections are failing because the databases  aren't online yet. None of these 18456 errors coorespond to the account reporting services
    runs under.
    The SQL logs indication Event 7009 occures before the "ReportingServer" database is online so im assuming there is a dependancy but I don't know how to avoid this.
    This problem is occuring on a number of our servers running SSRS (if not all)
    Any ideas?
    Paul

    Hi A141695,
    For Event ID 7009, you can try to do the steps below to resolve it.
        1. Click Start, click Run, type regedit, and then click OK.
        2. Locate and then click the following registry subkey:
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
        3. Right-click Control, point to New, and then click DWORD Value.
        4. In the New Value #1 box, type ServicesPipeTimeout, and then press ENTER.
        5. Right-click ServicesPipeTimeout, and then click Modify.
        6. Click Decimal, type the number of milliseconds that you want to wait until the service times out, and then click OK.
    For example, to wait 60 seconds before the service times out, type 60000.
    Quit Registry Editor, and then restart the computer. For more information about it, please see:
    http://www.sqlservercentral.com/Forums/Topic850540-1550-1.aspx#bm851211
    http://myitforum.com/myitforumwp/2012/08/22/configmgr-2012-sms_srs_reporting_point-component-failure/
    If you have any questions, please feel free to ask.
    Regards,
    Charlie Liao
    TechNet Subscriber Support
    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback
    here.

  • Event log for events from function module BP_EVENT_RAISE

    Hello experts,
    where can I look at the event log which where raised with the
    function modul BP_EVENT_RAISE.
    Thanks.
    Regards, Lars.

    this function module does not write a log by itself. and actually i would not know what should be in that log. usually you set up an event to trigger a follow-up process, so there's either the event was successfully triggered and your follow-up process has been started ... or it hasn't, which means: something went wrong ...
    Edited by: Mylene Euridice Dorias on Apr 16, 2008 10:42 AM
    i was just sap-netting with your problem and i found note [919458|https://websmp230.sap-ag.de/sap(bD1kZSZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=919458&nlang=EN&smpsrv=https%3a%2f%2fwebsmp205%2esap-ag%2ede] where they use program BTC_EVENT_RAISE instead of BP_EVENT_RAISE. the note says this program writes at least a line in the job-log so it might fulfill your requirements ...

  • "The event log file is full" error - SAP LVS Report Viewer 1.0

    Hi Experts,
    I'm getting an error when trying to generate a report in SAP LVS.
    Error:
    The event log file is full
    How do I resolve this? Anyone encountered this error?
    Thanks in advance,
    Cyrous

    Hi,
    It seems that the audit log mechanism is activated, at your system. But, if you didn't set the parameter DIR_AUDIT, audit log will be created under "/usr/sap/<SID>/<instance>/log", not "data" folder. You can check its default value on RZ11. Revise the parameters, below;
    DIR_AUDIT = <path>
    FN_AUDIT = audit_++++++++.AUD
    rsau/enable = 1
    rsau/max_diskspace/local = <SizeOfFile>
    Best regards,
    Orkun Gedik

  • Crystal Reports XI Crashes When Reporting on Event Log

    I have successfully connected to the event log on my local Windows 7 pc, as well as two different Windows 2003 server event logs. The report runs fine unless I include the field "DESCRIPTION" on the report. If I include that field, CR crashes with the following error in my event log:
    Faulting application name: crw32.exe, version: 11.0.0.1282, time stamp: 0x422d5c77
    Faulting module name: crheapalloc.dll, version: 9.2.0.4, time stamp: 0x422d5ade
    Exception code: 0xc0000005
    Fault offset: 0x00002454
    Faulting process id: 0x17e0
    Faulting application start time: 0x01ca58e2b9115606
    Faulting application path: C:\Program Files (x86)\Business Objects\Crystal Reports 11\crw32.exe
    Faulting module path: C:\Program Files (x86)\Common Files\Business Objects\3.0\bin\crheapalloc.dll
    Report Id: fe7f7599-c4d5-11de-a50a-001e4fe037ce
    I've found a few sites online that others have had the same problem, but I've not found a solution. Any suggestions from anyone here??

    Hi Carla, I moved this post to the database connectivity forum.
    It may be due to the size or of the text included int he description or MS is reporting the wrong size of the field.
    Other issue is XI is not supported on Windows 7 due to the age of CR and newness of Windows 7. CR XI is no longer patchable nor will any new OS platforms be added.
    What you can do though is download CR XI R2 for free and use your XI keycode to install it, then go to the Keycode Request site and get one for R2:
    Go to this link: http://www.sdn.sap.com/irj/boc and download the trial version of CR XI R2 and use your XI keycode, then apply the patches which you can get to by clicking on the BusinessObjects tab above, then Downloads.
    Test again and if it still fails you may have to wait for Service Pack 6 to come out, I believe we are adding Windows 7 to the supported OS's.
    Thank you
    Don

  • Event Log Reporting Time Span

    Having some connection problems, but can only see past one day in the Event Log. Get message "Limit of uservisible log" where in settings can I increase the report time to see past week or so, in Event Log ?

    It sounds like you have a home hub 3 with the latest firmware?
    You mean it looks like this - <<<<<<<<<<<<<<<<<<<< Limit of uservisible log >>>>>>>>>>>>>>>>>>>>
    I get the same. The hub event log used to give 3 full pages of events, now the maximum I get is 2 full pages and 7 events logged on the 3rd page (uses around ¼ of the page).
    You can't increase this, though if you have many events stored prior to the limit message, you could try switching the hub off to remove these older events or bite the bullet and factory reset the hub.
    -+-No longer a forum member-+-

  • Webcache reports 'Connect failed errno = 146' in Event Log

    Hi, when checking the webcache event log I keep getting the above message.
    The webcache server and the application server are physically separate boxes on the same network. There is a firewall between them.
    The webcache server runs purely webcache, the application server runs HTTP Server and OC4J. The connection from webcache to the application server is usually available but sometimes there is a timeout - which I'm assuming is related to the above.
    I understand that a 146 error is a socket connection error.
    Does anyone have any ideas on why I'm seeing this message and where I should start looking to sort it out ?
    Thanks,
    Paul.

    You said "There is a firewall between them.".
    That is probably the key issue here. Can you tell us what exactly is the firewall device. Is it transparent like some layer 3 or below device? With the given info, it is too wild to speculate what caused the connection failure. The problem is usually not in the application process running on the end system.

  • JavaScript Alert functionality in PL/SQL

    I'm in need of implementing the JavaScript "Alert" functionality (display message and wait for user to acknowledge) in the "before displaying the page" PL/SQL block of portal reports and forms. While I'm at it - How about the JavaScript "history.back" function as well?
    Is this possible? Can you point me in the right direction.

    Hi,
    Where Portal says "before displaying the page" what it means is that it will run this code before it starts to htp.p() out the HTML of the page.
    In WebDB this was actually what happened, in Portal there are some elements of HTML output BEFORE this block of code is run.
    Anyway I don't think that you can have an alert that displays before the page is loaded. The page will still show behind the alert.
    To get around this you would need a blank page to show your alert that forwards you on to the required page.
    The history function can be called by the onclick event of a button or you can access Javascript through an anchor tag:-
    link text
    Regards Michael

  • ESE - Event Log Warning: 906 - A significant portion of the database buffer cache has been written out to the system paging file...

    Hello -
    We have 3 x EX2010 SP3 RU5 nodes in a cross-site DAG.
    Multi-role servers with 18 GB RAM [increased from 16 GB in an attempt to clear this warning without success].
    We run nightly backups on both nodes at the Primary Site.
    Node 1 backup covers all mailbox databases [active & passive].
    Node 2 backup covers the Public Folders database.
    The backups for each database are timed so they do not overlap.
    During each backup we get several of these event log warnings:
     Log Name:      Application
     Source:        ESE
     Date:          23/04/2014 00:47:22
     Event ID:      906
     Task Category: Performance
     Level:         Warning
     Keywords:      Classic
     User:          N/A
     Computer:      EX1.xxx.com
     Description:
     Information Store (5012) A significant portion of the database buffer cache has been written out to the system paging file.  This may result  in severe performance degradation.
     See help link for complete details of possible causes.
     Resident cache has fallen by 42523 buffers (or 27%) in the last 903 seconds.
     Current Total Percent Resident: 26% (110122 of 421303 buffers)
    We've rescheduled the backups and the warning message occurences just move with the backup schedules.
    We're not aware of perceived end-user performance degradation, overnight backups in this time zone coincide with the business day for mailbox users in SEA.
    I raised a call with the Microsoft Enterprise Support folks, they had a look at BPA output and from their diagnostics tool. We have enough RAM and no major issues detected.
    They suggested McAfee AV could be the root of our problems, but we have v8.8 with EX2010 exceptions configured.
    Backup software is Asigra V12.2 with latest hotfixes.
    We're trying to clear up these warnings as they're throwing SCOM alerts and making a mess of availability reporting.
    Any suggestions please?
    Thanks in advance

    Having said all that, a colleague has suggested we just limit the amount of RAM available for the EX2010 DB cache
    Then it won't have to start releasing RAM when the backup runs, and won't throw SCOM alerts
    This attribute should do it...
    msExchESEParamCacheSizeMax
    http://technet.microsoft.com/en-us/library/ee832793.aspx
    Give me a shout if this is a bad idea
    Thanks

  • Thinking about using the Windows Event Logs as my main log store - looking for pros and cons

    I have been writing some larger scripts that write to physical log files.  Until today I have avoided trying to use the Windows Event logs, but, am beginning to rethink this and wondered if anyone has done this, and, what the strengths and weaknesses
    of this logging approach has been.  If I do it, I will probably write a function that accepts pipelined input and simply pass output to the log.  I wanted to get a feel for what I would be getting into before I started writing things up since this
    will probably take a little bit of work to get set up to run properly.

    At my company we use the Windows event log for many of our batch process logging for several reasons:
    Unlike logging to a central database, the Windows event log is always available. I've seen poorly thought out logging solution which log to a database and if the database happens to be unavailable the batch process would fail.
    Monitoring tool such as SCOM already have Windows event log watchers so adding alerts to take action based on message written to the Windows event log is easy
    Built-in support for writing Windows event log entries in the Powershell V2 write-eventlog cmdlet, a simple CLR can created in SQL Server or even command-line eventcreate.exe
    Easy to create a custom event log so you don't have to use the default application log in Windows 2008 and higher.
    Most shrink-wrap S/W already use the event log
    Issues I've seen:
    Windows 2008 with UAC on requires "registering" i.e. creating a new event log source with UAC. This can be done one time manually. Unfortunately there isn't a way to automate UAC--pure GUI. The Powershell command would be "New-EventLog -LogName Application
    -Source  mysource" if you're using the Application log and must be run as  administrator.
    Errant process writes many entries to the event log. Depending on the volume like for example writing stack dumps this can performance problems. I  think I recall an issue an Windows 2003 or Windows 2008 with UAC off  if you're creating a new
    event log source each time (which you shouldn't) then these results in many registry entries which can cause problems.
    I don't think the issues outweigh the benefits--just something to be aware of.

Maybe you are looking for