MonitorWare Console System Status Report - Advanced Filters

When you click on "Advanced Filters" button of "System Status Report", you will see a window as shown below:

Select Top Records

If you are not interested to view all logged records in your report, you can use this option to specify the number of records you would like to view in your report. You can also view all records by specifying 0 in the control box.

Limit Detail Events

Information occurs against a combination of FromHost, Event Log Type, Event Source, Event ID and Message. This option helps you specify the number of messages that you would like to view in your report. To view all messages just specify 0 in the text box.

Please note that this option works if you want to view a limited number of messages for the same values of FromHost, Event Log Type, Event Source and Event ID.

Remove Microsoft Links

Adiscon products are Windows based. Whenever a Windows service or process logs an entry in the Events Log, it may have such ingredients:

"Information Store (3286) Server Unregistered: Microsoft Exchange Server/Microsoft Information Store. For more information, click http://www.microsoft.com/contentredirect.asp"

Here, you can see a provided link by Microsoft for more information. Using this option, you can remove this link to decrease the size of your report.

Remove Logon ID from Events Having IDs = 528, 538 or 540

This option removes "Logon ID" from events having IDs 528, 538 or 540. For events like log on to network, network administrator may be interested in user id but not the logon id of the user. Let us consider the following example:

Sample Message for User Logon to Network

"Successful Network Logon: User Name: SomeWorkStation$ Domain: ABC Logon ID: [0x0, 0x2e16D315] Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name:"

If a user logs on to network for fifty times in a minute, he gets a different logon id for each logon. This results in fifty messages written in your file or database. You can check this option to get just one message with complete information except logon id in your report.

Remove Days Information from Events Having ID = 9533

This option is used to remove the days information from events having ID = 9533. Message for such events appears like this:

"The user account for user "XYZ (spam)" does not exist in the directory or is not enabled for exchange mail. This mail box will be removed from the mailbox store "First Storage Box/Mail Box Store/ABC" in 4 days".

Here, you may just encounter a difference in number of days i-e 4 days, 3 days and so on. This option removes this information from event messages and displays them in your report with better compression.

Remove Capacity Information from Events Having ID = 1221

This option deals with events having ID = 1221 and their messages appear like this:

"The database "First storage Group\Public folder Store (ABC)" has 366 megabytes of free space after online defragmentation has terminated".

In this case, you may get the same message again and again with just a change of number representing the capacity i.e. 366. Hence, this option removes this capacity information from messages before displaying them in report.

Remove “To Address” from Events Having ID = 2028

This option removes "To Address" from events with ID = 2028. An event like email delivery failure may give birth to a message like following:

"The delivery of a message sent by public folder INBOX-2-ABCB74C8791447DRT5678UIYTR has failed. To: abc@online.ch.ps. Cc: The non-delivery report has been deleted."

Each message may have a different To Address entry. This option removes this from message and helps in getting the concise report.

Remove the Size and No. of Pages from Events Having ID = 10

If you send 100 documents for printing , then each print operation may yield a separate message like:

"Document 40 http://home.abc.com/info.asp owned by xyz was printed on HP laserjet 4000 series PCL 6 via Port ip_162.0.1.12. size in bytes: 52317; Pages Printed: 1".

Now, there will be primarily a difference of Size in Bytes and Pages Printed entries in 100 messages. Therefore, checking this option saves you from this overload and generates only one message instead of 100.

Remove "This Occurred 9423 Time(s) in the Past 16:57 Hours." Line from Events Having ID = 14079

These messages appear like as given below:

"Due to unexpected error, the service xyz stop responding to all requests . This occurred 378 time(s) in the past 16:41 hours. Try to stop the service or kill the corresponding process. If it does not respond, and start it again. Check the Event Viewer for related error messages".

Here, we may just have difference in “This occurred 378 time(s) in the past 16:41 hours.” line i.e. the number of times service stopped responding and the time duration for which it was not responding. So, this option removes this line and helps in getting the concise report.

Remove the Number in the Brackets after the Word "Information Store" and "MSExchangeSRS" from All Events Having Event Source = "ESE"

A sample message for this case appears like this:

"Information Store [2476] the database engine 1.0.629.000 started".

Now, there can be only a difference of number in bracket, following the Information Store. This option removes this information store number and yields fewer messages to display in the report with required information.

Note: