Video Screencast Help

MSSQL collector only reading events once

Created: 28 Jun 2012 | 4 comments
Isaac Mungai's picture

Hi all,

I need some help. I set up mssql server 2005 collector, with the correct path, correct Error logfile name, reading mode is monitor single file log, and reading from last position. When i set it up first time, events were read..but now they are not reading the events in realtime as i expected.

Question: Should do anything on the SQL Server, like add a port to listen to..or what should i do?My aim is to have realtime logs streaming in.

Thanks.

Comments 4 CommentsJump to latest comment

TatyanaS's picture

Hi, Isaac!

Can you try to use MonitorDinamicLog instead of SingleLog. Using this property you will make the collector check for logfiles with greater modification date in your folder. MS SQL Server rewrites ERRORLOG file each time with greater modification date if I'm not mistaken. This may help. 

-Tatyana

Isaac Mungai's picture

Hi Tatyana,

I've tried both methods, but i think MonitorSingleLogFile reading mode should be the one to be used since it monitors an always active log file, like ERRORLOG for MSSQL. I've used dynamic mode on a different collector and it works well when the log file has reached its limit size and sent at once to the SSIM server and the server has time to read its content before another new one is generated.

I think what is happening is that for the sql collector, as much as the error log file hasn't reached it limit size, it reads only once, assuming that the logfile is "filled" up at the time of collecting and when it is done before a new event is recorded, it won't read any other events until a new blank ERRORLOG file is created.

Is this how the collector works?And i wanted to ask, should i put port 1433 on the SQL Server to listen for network requests from SSIM so that i get realtime events from the active ERRORLOG before it fills up?

Thanks.

TatyanaS's picture

I assume you're using MS SQL Server Error Event collector 4.4.

If so, then it uses LogFile sensor and it doesn't require additional special configuration for MS SQL Server - collector needs only access to ERRORLOG file to read from.

Actually, sensor reads events in real time - that means if there is new entry appear in ERRORLOG file - it will read by the collector in a moment. So, it should read new events which appear in your logfile even if new ERRORLOG file is not created.

So, this is weird behaviour and I would like to ask you to take a look at collector's log - doesn't it contain any ERROR or WARN messages?

-Tatyana

Isaac Mungai's picture

Hi Tatyana,

Sorry for the delay..I've been really held up.

I have been using the MS SQL svr 2005 Event Collector v4.2.4. Could that be the issue, instead of using the MS SQL Server Error Event collector 4.4? I'll have to try this at a test environment, and i'll respond the outcomes.

So, just to be clear, if i may ask, at which situation would i use the MS SQL svr 2005 Event Collector v4.2.4 and MS SQL Server Error Event collector 4.4?