WMI Query to monitor eventviewer

Started by Luiz A. Camilo, October 31, 2011, 02:53:27 PM

Previous topic - Next topic

Luiz A. Camilo

Hi there,

I´m using this WMI Query to monitor if a particular event happened on windows eventviewer.

WMI.Query(root\CIMV2\, Select * from Win32_NTLogEvent Where Logfile = 'Application' and EventType = '1' and EventCode = '9006')

The query works great fine, but in WMI it returns several Rows, and I believe that netxms doesn´t know how to deal with those results. So I tried to "Count", but in WMI Count is a property, and not a function. So I cannot make changes in WMI side.

I´m looking for clarification if this is supported in Netxms, or if can I use a transformation script or something like this to get a number of rows, or a value that Netxms can understand and display.

Ideas are great apreciated.

Thanks in advance

Victor Kirhenshtein

Hi!

Looks like it is not possible with current implementation of WMI.Query. I'll take a closer look at it in a few days - looks like this functionality can be added with simple changes in WMI subagent.

Best regards,
Victor

Victor Kirhenshtein

Hi!

I have added special option to get number of rows in WMI query result set - if you give %%count%% as property name, agent will return number of rows.

Best regards,
Victor

lindeamon

hi victor,

was it implemented in v1.1.6 ?

Best Regards,
lindeamon

Victor Kirhenshtein

No, I do it today. Version 1.1.7 will include this feature. If it is needed right now, I van make cudtom build of agent.

Best regards,
Victor

lindeamon

hi victor,

there is no necessary need for now.
i can wait for the new version.

Best Regards,
Lindeamon

lindeamon

hi victor,

what about snmp ? can you create something like this for snmp queries ?

Best Regards,
Lindeamon

denser.ru

#7
Quote from: Victor Kirhenshtein on November 13, 2011, 11:17:29 AM
Hi!

I have added special option to get number of rows in WMI query result set - if you give %%count%% as property name, agent will return number of rows.

Best regards,
Victor
in result - where i should give %%count%% ? What field of DCC?
WMI.Query(root\CIMV2\, Select %%count%% from Win32_NTLogEvent Where Logfile = 'System' and EventType = '3' and EventCode = '1020')
like this?

Victor Kirhenshtein

Hi!

It should be like this:


WMI.Query(root\CIMV2\, Select * from Win32_NTLogEvent Where Logfile = 'System' and EventType = '3' and EventCode = '1020',%%count%%)


Best regards,
Victor