EventLog Analyzer 4 on Win2003 Sp1 (Some issues)
Hi!
First of all, thank you for your helpful product and, as I've noticed in this forums, outstanding support and advices....
Our company is quite interested (my department in particular) in using your products - right now we are interested in EventLog Analyzer (ELA) and FireWall Analyzer.
About 3 weeks ago I started using ELA on Win2000 Server Sp4 with 256 Ram (old test server, indeed) - and it worked like a charm, and I mean it. Perfect availability 24/7, pretty stable and fast (to make a final decision we used trial version and analyzed logfiles from 4-5 hosts only - Unix and Windows). Last week we get a new server for this needs, as a final stage before making business decision... And here comes most interesting part of the story... PROBLEMS
About this server: HP Proliant ML110, 3.2 Ghz, 512 Ram (for now), 80 GB SATA RAID I, 80 GB SATA Single HDD, Windows Server 2003 SP1 Enterpise Edition (all updates up to date). Right now we are trying to monitor 4 hosts - 2 Windows and 2 Unix hosts. First couple of days it was badly unstable and annoying - sudden crashes and we couldn't pass through login interface - no errors, whatsoever... So, old good Task Manager and End process did it work - but it was very-very-very annoying. Later I went through FAQ/Troubleshouting Tips/Forums on your corporate site (this one
). The only thing I found similar was adding to boot.ini Execute=AlwaysOff (Physical Address Extension issue), so right now part of boot.ini is looking like this:
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows Server 2003, Enterprise" /Execute=AlwaysOff /fastdetect
And It was ok! For two days only... First day/night - no problem, I thought - thanks to god: we did it - and on the second day I've additionally installed FireWall Analyzer, because it looks really useful for us as well...it was yesterday (I didn't configured this Firewall Analyzer, just started it). Today we have "same shit different day" - can't login - no errors what so ever (mysql-nt and SysEvtCol.exe are running, no errors in EventLogs too)...process restrart...
Maybe it's impossible to run two of your products on the same server?
I've noticed constant warning in Event Viewer/Application - Mysql Can't open and lock time zone table: Table 'mysql.time_zone_leap_second' doesn't exist trying to live without them.
At the EventLog Analyzer web interface there is also a good looking calendar and we have annoying bug overthere as well - all the time it shows undifined, Nan (I have no idea what does it mean), so you have to select Today, then it will show November, 2005 (for example). But if you choose to check couple of days back (clicking on particular day inside this calendar - it will be again undifined, Nan), speaking of time period at Dashboard it will be shown correct (From: --- To:---).
Speaking of reports we have this nasty error at Trend reports (selecting Severity based trend for example) we got:
All Events Daily Trend
Tag 'insert' can't insert page '/trend_details.do'. Check if it exists. Null 'period' argument. java.lang.IllegalArgumentException: Null 'period' argument. at org.jfree.data.time.TimeSeries.addOrUpdate(TimeSeries.java:581) at com.adventnet.la.RSDatasetModel.produceTimeSeriesDataSet(RSDatasetModel.java:753) at com.adventnet.la.RSDatasetModel.produceCompareDataset(RSDatasetModel.java:522) at com.adventnet.la.RSDatasetModel.produceDataset(RSDatasetModel.java:213) at de.laures.cewolf.taglib.DataContainer.getDataset(DataContainer.java:53) at de.laures.cewolf.taglib.SimpleChartDefinition.getDataset(SimpleChartDefinition.java:34) at de.laures.cewolf.taglib.SimpleChartDefinition.produceChart(SimpleChartDefinition.java:30) at de.laures.cewolf.taglib.AbstractChartDefinition.getChart(AbstractChartDefinition.java:81) at de.laures.cewolf.taglib.ChartImageDefinition.ensureRendered
....
....
....
bla...bla...bla
We are really interesting in using your product/-s, but we have to make it work like it should be (and it worked outstanding actually on old server with Win2000 Server).
Thank you for cooperation in advance...
Aleksejs,
from Riga, Latvia
First of all, thank you for your helpful product and, as I've noticed in this forums, outstanding support and advices....
Our company is quite interested (my department in particular) in using your products - right now we are interested in EventLog Analyzer (ELA) and FireWall Analyzer.
About 3 weeks ago I started using ELA on Win2000 Server Sp4 with 256 Ram (old test server, indeed) - and it worked like a charm, and I mean it. Perfect availability 24/7, pretty stable and fast (to make a final decision we used trial version and analyzed logfiles from 4-5 hosts only - Unix and Windows). Last week we get a new server for this needs, as a final stage before making business decision... And here comes most interesting part of the story... PROBLEMS
About this server: HP Proliant ML110, 3.2 Ghz, 512 Ram (for now), 80 GB SATA RAID I, 80 GB SATA Single HDD, Windows Server 2003 SP1 Enterpise Edition (all updates up to date). Right now we are trying to monitor 4 hosts - 2 Windows and 2 Unix hosts. First couple of days it was badly unstable and annoying - sudden crashes and we couldn't pass through login interface - no errors, whatsoever... So, old good Task Manager and End process did it work - but it was very-very-very annoying. Later I went through FAQ/Troubleshouting Tips/Forums on your corporate site (this one
). The only thing I found similar was adding to boot.ini Execute=AlwaysOff (Physical Address Extension issue), so right now part of boot.ini is looking like this:[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows Server 2003, Enterprise" /Execute=AlwaysOff /fastdetect
And It was ok! For two days only... First day/night - no problem, I thought - thanks to god: we did it - and on the second day I've additionally installed FireWall Analyzer, because it looks really useful for us as well...it was yesterday (I didn't configured this Firewall Analyzer, just started it). Today we have "same shit different day" - can't login - no errors what so ever (mysql-nt and SysEvtCol.exe are running, no errors in EventLogs too)...process restrart...
Maybe it's impossible to run two of your products on the same server?
I've noticed constant warning in Event Viewer/Application - Mysql Can't open and lock time zone table: Table 'mysql.time_zone_leap_second' doesn't exist trying to live without them.
At the EventLog Analyzer web interface there is also a good looking calendar and we have annoying bug overthere as well - all the time it shows undifined, Nan (I have no idea what does it mean), so you have to select Today, then it will show November, 2005 (for example). But if you choose to check couple of days back (clicking on particular day inside this calendar - it will be again undifined, Nan), speaking of time period at Dashboard it will be shown correct (From: --- To:---).
Speaking of reports we have this nasty error at Trend reports (selecting Severity based trend for example) we got:
All Events Daily Trend
Tag 'insert' can't insert page '/trend_details.do'. Check if it exists. Null 'period' argument. java.lang.IllegalArgumentException: Null 'period' argument. at org.jfree.data.time.TimeSeries.addOrUpdate(TimeSeries.java:581) at com.adventnet.la.RSDatasetModel.produceTimeSeriesDataSet(RSDatasetModel.java:753) at com.adventnet.la.RSDatasetModel.produceCompareDataset(RSDatasetModel.java:522) at com.adventnet.la.RSDatasetModel.produceDataset(RSDatasetModel.java:213) at de.laures.cewolf.taglib.DataContainer.getDataset(DataContainer.java:53) at de.laures.cewolf.taglib.SimpleChartDefinition.getDataset(SimpleChartDefinition.java:34) at de.laures.cewolf.taglib.SimpleChartDefinition.produceChart(SimpleChartDefinition.java:30) at de.laures.cewolf.taglib.AbstractChartDefinition.getChart(AbstractChartDefinition.java:81) at de.laures.cewolf.taglib.ChartImageDefinition.ensureRendered
....
....
....
bla...bla...bla
We are really interesting in using your product/-s, but we have to make it work like it should be (and it worked outstanding actually on old server with Win2000 Server).
Thank you for cooperation in advance...
Aleksejs,
from Riga, Latvia