Hi, The only thing I want to do with this software, is watch for windows event log errors and warnings, and send some mails as soon as they occurr. So this is a plain vanilla setup. After adding the agent resources, I click on the machine (dns name) resource, I click on the inventory tab, I click on "configuration properties" and I enable log tracking to "system". The "Track event log level" i put to "Warn". Next step: I click on the Alert tab, and I define a new alert that checks "Events/Logs Level:" of level "Any", and enable actions, each time this condition is met. So far so good. This one works. I add a printer and delete it again, and I see a nice warning.
But I want to watch ALL event logs, not only the system even log. On the screen is indicated that I can use "*" to select all logs, or separate them with ",". Both of these setups generate a massive amount duplicate key errors from PostgresSQL in my Application Event log.
Probably I am not doing things the right way. Can anybody help me out here?
If so, those errors are unrelated to your log track changes and are being caused by metric data points being 'bucketed' into the same time slice. This can occur when you have resources that are marked down by the HQ server, but then get updated when the actual datapoint is sent in from the agent.
This problem has been addressed in our upcoming 3.1 release, which no longer has to do updates on the measurement tables.