SB EventLog Monitor / News: Recent posts

A new version of the EventLogMonitor Agent is available for download.

The biggest change is that the Agent now supports NT4 workstations and servers. Pre-install requirements for NT4 are that both Service Pack 6 and Internet Explorer 4 (with the Active Desktop Update) or above are installed on the target computers. There continues to be no special pre-requisites for Windows 2000 and above.

Please ensure you have the updated version of the rpc.php file mentioned in the last news post (http://sourceforge.net/forum/forum.php?forum_id=720486) otherwise no events will be reported to the server.... read more

If You have problems with receiving events from Windows Agent, please update SB ELM to latest revision from SVN repository... The SVN revision 39 should fix this issue.
If You don't want or can't use SVN, You can download just the modified version of RPC.php from this link: http://eventlogmonitor.svn.sourceforge.net/viewvc/\*checkout*/eventlogmonitor/trunk/htdocs/rpc.php

Please... keep backup of Your current RPC.php - there can be compatibility problems. Also You have to update MySQL schema for table "sbevtlog_secrets".... read more

changelog:
Support for reporting only certain types of event instead of all types
Added workaround for FormatMessage crash
Improved error handling in constructors
Events now reported if Agent can't start or open required registry keys
Removed coupling between LogManager and EventLogMon classes

changelog:
Exception information is now logged to the Application event log rather than a file
GetOsVersion now reports 64-bit OSes
Free functions now moved to separate file
Casts changed to C++ syntax
Removed fixed length buffer from Message::FormatFullMessage
Removed unnecessary static stringstreams as the memory leak bug in MSVC2005 has been fixed
Sid retrieval now in a class
Added define in main.cpp to allow toggling between service and application startup for debugging purposes
Added port detection and did some cleanup on the config tool

This release is only available in SVN...
SB EventLog Monitor version 0.76 has been released. There is one IMPORTANT function in this version - "MySQL table schema Auto Update" - SB ELM will update MySQL tables without Your interaction, so this will make updating more easy ;)
Also, this release is pre-beta3... So the next release (probably 0.80 beta3) should be here soon.

full change log:
0.76
* added MySQL table schema AutoUpdater - all MySQL tables will be updated automaticly since this version
* few tweaks of user interface
* added "reload" button (into "auto refresh" selection box
* updated help (only English)
* updated "WMI-EVENTS.vbs" collector... read more

Updated version of Windows agent has been released.

change log:
* service should be a little bit faster
* fixed few small bugs
* config tool was updated (automatically put the IP of the machine into the "Server IP" field)

There are some "speed" related problems. It is caused by "badly" designed MySQL indexes.
This issue will be addressed in next release. If You have problems with slow access to the summary page after login, You can apply the "hotfix". More information about this can be found in this discussion: http://sourceforge.net/forum/forum.php?thread_id=1694787&forum_id=639781... read more

Version 0.74 is out ;)
Most important is patch for the "1664214: Error accessing web page" bug (affecting only instalations with disabled user access control).
There are two new requested features and one non-requested feature...
Every computer can be member of more than one group :D Also, when You rename or delete group, this will be reflected to "Alert filters" rules.

The second new feature... You will be able to see computer description on "Monitored computers" page (description is updated automatically from monitored machines).
note: If You are using EventLogMonitor agent, You must update it to version 1.01. If You don't do this, You won't see be able to get "computer description". All other thinks, WILL work.... read more

Updated EventLogMonitor agent has been released. This updated is needed to use all functionality with SB ELM 0.74 (will be released soon).

You can use this version with any older version of SB ELM. This version is backward compatible ;) Also You can use older agent with newer SB ELM (but You will loose new functionality).

===UPDATING===
* You must uninstall older version of ELM agent before installing this new one
* if You are NOT using NETLOGON share to configure agent, You must import configuration to the registry again (from REG file)!... read more

As was reported in BUG report "[1664214] Error accessing web page" there is one small bug in version 0.73.

Due to change in User Access Control, when You disable integrated UserAuth, You won't be able to access SB ELM. FULL FIX will be included in next release.

For now, You can apply hotfix on Your own...

1. open INDEX.PHP for editing
2. find this line $template_file = $_GET["module"] . ".tpl";
3. add this one line before the line above: if (empty($_GET["module"]))
$_GET["module"] = "showSummary";
4. save INDEX.PHP
5. fixed.... read more

I have just uploaded the new version 0.73!
There are several bug fixed, but also several important (and asked) features... The most important change is the "User Access Control" system! Each user can be member of user groups. You can restrict access to every user group - limit access to only selected modules and/or only selected computer groups. If the user is NOT member of any group he/she has FULL access to everything (as it was in earlier versions).... read more

I have just uploaded the first beta version of EventLog Monitor agent. This is a Windows service, that will do the collecting of events on the remote machine and will post them back to the ELM server.

You can read more here: http://sourceforge.net/docman/display_doc.php?docid=43594&group_id=183663

Note: This is the first public release, so please do not use it on production servers / clients. This release is only meant for testing.

I have just released new version of beta2 (0.72). This is mostly Bug Fixes, but there are also several changes. The most important change is new SWF graphs component used on the Summary page.
Thanks to donation from "anchornet" and thanks to support from AnyChart, this project has a new licensed "Anychart Flash Chart Component". License has been granted for this project only. You can't reuse the SWF component outside this product.... read more

Warning!
If You have downloaded the new version 0.71 today, please RE-DOWNLOAD it (version 0.71b).
There was one BAD file (core.js), that can cause refreshing of several pages (summary, eventlog and alerts).
I'm sorry for that. New release has a fixed file. Old release was deleted.

----------------------------------------
Version 0.71 has been released... There are several fixes and few new functions. ... read more

Version 0.71 has been released... There are several fixes and few new functions.

Please note, that since this version You can use more than one email address in Filter rules alerting (use ";" as delimiter). If You want to use this feature and You are also using "Once Per" feature, You MUST update MySQL table structure (You won't loose any data).
ALTER TABLE `sbevtlog_queue_alert` CHANGE COLUMN `queue_mailto` `queue_mailto` tinytext NULL;... read more

I have just uploaded updated ICONS for beta2 (and / or beta1). So... if You want to see new icons (there are still 2 icons missing), You can. Just go to download and You will see them :D
Extract the downloaded ZIP file to folder, where SB EventLog Monitor PHP scripts are stored ;)

Special thanks goes to Seth Bareiss for making these icons :D

I have just release beta2 of SB EventLog Monitor. There are several changes, but the main functionality is the same.
You have to update DB tables, but there should be no data lost after structure update. Anyway, doing db backup is a good idea.

Change log:
0.70
* first beta2 public release
* basic help (english only) added

***** BETA2 ******

0.69 (internal)
!!! MySQL table change !!!
* group support - You can filter computers on Events page by group
* group support in rules!
* OS version number has been removed from OS name (also word Microsoft has been cutted down)
* alert Filetrs "Once per" - send only one email per ? minutes for this filter/computer combination (0 = disable) THIS is AntiOverload feature
* fixed: problems with MySQL5.x
* better cache control
* RPC server for EventLog Monitor agent (Windows Service)
* added config line in VBS collector to disable PingCheck (disable it when running on windows 2000 or when Your firewall blocking incoming ping)
* fixed: you can't add computer that is already in database... read more

Please take a short survey about EventLog monitor. You can find survey at this URL http://www.zoomerang.com/survey.zgi?p=WEB2262MR79S43
Thanks for the feedback.

In current version of SB EventLog Monitor are few problems with MySQL 5.x server. This will be fixed in next beta (coming in half of January).
If You can't wait, You can download patch (two files). (Patch is not properly tested).

Beta2 is now under testing in real environment and only few thinks has to be fixed or added.

What are the key-news?
* few changes on the Summary page (added Alerts summary and Last alerts)
* new JavaScript in Rules creation (more features)
* Group support - You can filter computers on Events page by group
* Alert Filetrs "Once per" - send only one email per ? minutes for this filter/computer combination (0 = disable) THIS is AntiOverload feature... read more

Attention everyone... If You are running SB EventLog Monitor under Windows 2000, you will NOT get any events and collector script will say "Client is Offline".

There is no fix, but there is one work-around.
Edit WMI-EVENTS.vbs file (under data directory) and change this code:

Set objPing = GetObject("winmgmts:{impersonationLevel=impersonate}").ExecQuery("select * from Win32_PingStatus where address = '" & strLine & "'")
For Each objStatus in objPing
If IsNull(objStatus.StatusCode) or objStatus.StatusCode<>0 Then
Wscript.Echo "Client is Offline: " & strLine
Else
Wscript.Echo "Reading events from: " & strLine
GetEvents trim(strLine)
End If
Next... read more

Changes:
* added support for REGEX (eregi and preg_match)
* changed Alert email subject
* added Filter Rules IMPORT and EXPORT
* fixed bug in paging (Events, Alerts)
* added some missing texts to Czech translation
* fixed bug in WMI-EVENTS.vbs collector
* fixed several small bugs in templates
* fixed several small bugs in code

First public beta version is out. If You find bug, or just a grammar or keying mistake, please let me know!

I have just finished translation, so now the SB EventLog Monitor supports Czech and English localization. This was the last "big" think, that was slowing down public beta release.
So... I have to fix two minor bugs and first beta will be released. Stay tuned :D