WMI Query to monitor eventviewer

[hadesfromhell]

Hi there,

I´m using this WMI Query to monitor if a particular event happened on windows eventviewer.

WMI.Query(root\CIMV2\, Select * from Win32_NTLogEvent Where Logfile = 'Application' and EventType = '1' and EventCode = '9006')

The query works great fine, but in WMI it returns several Rows, and I believe that netxms doesn´t know how to deal with those results. So I tried to "Count", but in WMI Count is a property, and not a function. So I cannot make changes in WMI side.

I´m looking for clarification if this is supported in Netxms, or if can I use a transformation script or something like this to get a number of rows, or a value that Netxms can understand and display.

Ideas are great apreciated.

Thanks in advance

[victor]

Hi!

Looks like it is not possible with current implementation of WMI.Query. I'll take a closer look at it in a few days - looks like this functionality can be added with simple changes in WMI subagent.

Best regards,
Victor

[victor]

Hi!

I have added special option to get number of rows in WMI query result set - if you give %%count%% as property name, agent will return number of rows.

Best regards,
Victor

[lindeamon]

hi victor,

was it implemented in v1.1.6 ?

Best Regards,
lindeamon

[victor]

No, I do it today. Version 1.1.7 will include this feature. If it is needed right now, I van make cudtom build of agent.

Best regards,
Victor

[lindeamon]

hi victor,

there is no necessary need for now.
i can wait for the new version.

Best Regards,
Lindeamon

[lindeamon]

hi victor,

what about snmp ? can you create something like this for snmp queries ?

Best Regards,
Lindeamon

[denser.ru]

@victor said in WMI Query to monitor eventviewer:

Hi!

I have added special option to get number of rows in WMI query result set - if you give %%count%% as property name, agent will return number of rows.

Best regards,
Victor

in result - where i should give %%count%% ? What field of DCC?

WMI.Query(root\CIMV2\, Select %%count%% from Win32_NTLogEvent Where Logfile = 'System' and EventType = '3' and EventCode = '1020')

like this?

[victor]

Hi!

It should be like this:

WMI.Query(root\CIMV2\, Select * from Win32_NTLogEvent Where Logfile = 'System' and EventType = '3' and EventCode = '1020',%%count%%)

Best regards,
Victor