3.38 ReplEventLog

Use this Knowledge Script to periodically scan the Directory Service log for Active Directory replication errors. This script raises an event if any Active Directory replication errors are found.

During the first monitoring interval, the value you specify for the Directory Service log entries to scan parameter determines how far back in the log to check for matching entries. As the script continues to run at subsequent intervals, it checks for any new entries created since the last time the log was checked.

You can further restrict the types of log entries that raise an event by using the Filtering parameters:

  • Use the Event Type parameters to search only certain types of events, such as Warning events.

  • Use the Other parameters to search only for specific information, such as events associated with a specific user or computer name.

Each time this script runs, it checks the Directory Service log for entries matching your selection criteria and raises an event if matching entries are found. The event detail message returns the text of the log entries found. When this script is set to collect data, it returns the number of log entries found, and the data point detail message returns the text of the log entries.

3.38.1 Resource Objects

Active Directory domain controller

3.38.2 Default Schedule

The default interval for this script is Every hour.

3.38.3 Setting Parameter Values

Set the following parameters as needed:

Parameter

How to Set It

General Settings

Raise event if job fails

Event severity when job fails

Set the severity level, from 1 to 40, to indicate the importance of an event in which the ReplEventLog job fails. The default is 35.

Monitor Directory Service log for replication events

Raise event if matching log entries found?

Select Yes to raise an event if log entries are found that match the filters you set. The default is Yes.

Start with events in past

Set this parameter to control checking for the first interval, after which, checking is incremental:

  • -1--all the existing entries

  • n--the past n hours (8 for the past 8 hours, 50 for the past 50 hours, etc.)

  • 0--no previous entries (only search from this moment on)

The default is 0.

Filtering

Event Types

Error

Select Yes to monitor Error entries. The default is Yes.

Warning

Select Yes to monitor Warning entries. The default is unselected.

Information

Select Yes to monitor Information entries. The default is unselected.

Success Audit

Select Yes to monitor Success Audit entries. The default is unselected.

Failure Audit

Select Yes to monitor Failure Audit entries. The default is unselected.

Other

Filter -- Category

To monitor events in a particular category, such as Server or Logon, enter an appropriate search string. This script looks for matching entries in the Directory Service Log’s Category field. Multiple strings can be entered separated by commas.

The search string can contain criteria used to include entries, exclude entries, or both. Separate the include and exclude criteria with a colon (:). If you are specifying only include criteria, the colon is not necessary.

Filter -- Event ID

To monitor particular event IDs, enter an appropriate search string or ID range, for example 100-2000. This script looks for matching entries in the Directory Service Log’s Event field. Multiple IDs and ranges can be entered separated by commas (for example: 1,2,10-15,202).

The search string can contain criteria used to include entries, exclude entries, or both. Separate the include and exclude criteria with a colon (:). If you are specifying only include criteria, the colon is not necessary.

Filter -- User

To monitor events associated with a particular user, enter an appropriate search string, for example, DomainName\UserName. This script looks for matching entries in the Directory Service Log’s User field. Multiple strings can be entered separated by commas.

The search string can contain criteria used to include entries, exclude entries, or both. Separate the include and exclude criteria with a colon (:). If you are specifying only include criteria, the colon is not necessary.

Filter -- Computer

To monitor events generated by a particular computer, enter an appropriate search string. This script looks for matching entries in the Directory Service Log’s Computer field. Multiple strings can be entered separated by commas.

The search string can contain criteria used to include entries, exclude entries, or both. Separate the include and exclude criteria with a colon (:). If you are specifying only include criteria, the colon is not necessary.

Filter -- Description

To monitor events with a particular detail description or containing keywords in the description, enter an appropriate search string. This script looks for matching entries in the Directory Service Log’s Description field. Multiple strings can be entered separated by commas.

The search string can contain criteria used to include entries, exclude entries, or both. Separate the include and exclude criteria with a colon (:). If you are specifying only include criteria, the colon is not necessary.

Event Notification

Maximum number of entries per event message

Set the maximum number of Directory Service log events that can be returned in each event report.

For example, if this value is set to 30 and 67 Directory Service log events are found, then three event reports are raised: two reports containing 30 events and one report containing seven events.

The Message column on the Events tab in the Operator Console displays the number of events in each event report, the type of log the events are from, and the event report batch number. The batch number is the sequential number of the event report. Batch numbers start at 1 for each Knowledge Script iteration.

The default is 1 entry.

Event severity when new log entries found

Set the severity level, from 1 to 40, to indicate the importance of an event in which new log entries are found. The default is 10.

Data Collection

Collect data for number of matching entries found?

Select Yes to collect data for charts and reports. If enabled, data collection returns the number of Directory Service Log entries that match your filtering criteria. Additional information is supplied in the data detail message. The default is unselected.