unicolet.org

Just a quick note to self that to enable/disable/query event log registration from the command line on Windows releases greater than XP and Server 2003 you can use the wevutil tool. For example to enable logging of print requests on Windows 7 for auditing purposes: wevtutil sl Microsoft-Windows-PrintService/Operational /e:true The equivalent command for the the above on Windows XP is the following: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers /v EventLog /t REG_DWORD /d 7 /f net stop spooler net start spooler

A common problem with OpenNMS is how to monitor a log file and trigger alerts when certain conditions are met. Let me clarify with an example: you have this mission critical app that sometimes experiences internal errors. The application keeps running and still responds to requests, but the error will slow down the system and/or delay further processing. Monitoring the process and/or network polling will obviously not be able to detect the issue and the only way is to tail the application log file and look for certain messages. The problem can usually be solved simply by forwarding the log file to OpenNMS through syslog, but what for logs generated by applications that don't speak syslog or if you don't want to configure syslog forwarding?

As much as I like to delve in cutting edge tech, to make a living I also provide systems administration services on old-school environments, where ahem Windows rules. One problem that's been biting me (daily!) for some time now is that on a Win2k3 Storage Server Event ID 333 will often surface, requiring a reboot. After checking all software, disabling antivirus, analyzing memory pools and all the usual (and unusual) stuff it turned out that the cause of the problem was the NFS server. I moved all shares to an EMC NAS, modified mount points, disabled the NFS service and the issue has been gone for the last two weeks.