Is It Possible to “Collect” Event IDs and Fire an Action in ControlUp?

It was asked if it is possible to "collect" event IDs and fire an action when a certain event ID happened multiple times within a certain time frame. Currently, this is not possible, however, users can use a workaround with a Powershell script and event triggers. A related request has been submitted to ControlUp, and can be found at https://controlup.uservoice.com/redirect/suggestions/46413556.

Read the entire ‘Is It Possible to "Collect" Event IDs and Fire an Action?’ thread below:

Somebody have a quick idea if its possible to "collect" event IDs and fire an action when e.g. event ID "3" happened 30 times in 5 minutes…

not yet, there’s a request open for it. Let me get you the UV link

here you go: https://controlup.uservoice.com/redirect/suggestions/46413556

thanks Wouter

if you want to use a workaround you could though

I am all ears Dennis 🙂

Powershell script that:

Checks how often event ID 3 happened in the last 30 minutes. I haven’t tested the script below but you get the idea

> $eventLogName = "Application"

> $id = 3

> $threshold = 30

> $timeframe = 5

> $filterhash = @{logname=eventLogName;id=$id;starttime=([datetime]::Now.AddMinutes(-$timeframe))}

> [array]$number = Get-WinEvent -FilterHashtable $filterhash

> if($number.count -ge $threshold)

> {

> Write-EventLog -LogName Application -Source "Supertriggers" -EntryType Warning -Message "Event ID 3 happened more than 30 times in the last 5 minutes" -EventId 1337

> }

Create trigger 1 that fires on event ID 3

Now create a 2nd event trigger in the console for source supertriggers, eventID 1337 and run your actual follow action

Thanks Dennis, I actually came across to the customer with a very similar idea but this specific customer doesnt want to use it this way.

The customer is using Microfocus Operations Bridge Manager for central monitoring and we are pushing the events via Trigger (WebHook) to OpsBridge because there we can correlate the events and push out a message to the admins.

Its also a workaround so it would be nice to have it in the product…

Continue reading and comment on the thread ‘Is It Possible to “Collect” Event IDs and Fire an Action in ControlUp?’.  Not a member? Join Here!