EventReporter 6.4 Final Release

Service Changes

• Added new Services

  - MonitorWare Echo Reply and Request Services, these two services together can be used to check in real-time if MonitorWare Agents are alive. The Echo Reply service is used on each of the installed agents. Then, a central agent is using the Echo Request and instructed to poll each of the other Agents. When the Request can not be carried out successfully, an alert can be generated. The MonitorWare echo protocol ensures that always a fresh probe of the remote agent is done.

• Protect Agent against Service shutdown - This new feature has been added. When enabled, the Agent will not stop processing the internal queue when it is stopped. Please note that it will remain in the stopping state then.
• Event Log Monitor -  Enhanced error handling for event log corruption. This happens very seldom, but it can happen (Harddisk error or other unexpected problems can cause event log corruption). The event log monitor now has 3 Options to deal with corruption.
  1. Ignore corrupted entries, so event log Monitor will try the event which comes after the corrupted one.
  2. Retry processing from beginning, this will reprocess the whole event log from the beginning.
  3. Clear all events from the event log. If configured, the concerned event log and all it's entries will be totally cleared. This will solve the corruption but all events will be lost.

Client Changes

• Introduced a few usability and stability changes like

  - Use CTRL + S to save your settings
  - Move Rules & Actions up and down by using Toolbar buttons (Fast then the context menu)
  - Highlighting of the current selected entry in the Tree view
  - Reorder of the Rule & RuleSet menu.

• Expanded in Treeview - Is now saved. That means the Client will open exactly like you left it last time.
• Filter Editor - Enhanced the filter editor with a few new features. This includes copy&paste, add comments per filter and minor others. The copy&paste feature works also between different rules and filter sets.
• Handling Actions - Actions are also copy&paste able now. You can copy&paste them between rules and even rulesets if you want.

Bug fixes

• SMTP Action - Fixed a bug which could cause multiple socket errors if the mail server disconnected during transmission.
• Filter Engine - Fixed a bug with the Event Type filter, it was ignored.
• Property Engine - Fixed a bug that the %NTEventLogType% property could not be found.
• General - When an empty Syslog tag value was configured in any service, garbage could be used instead. This has been corrected.
• General - Fixed a bug that could cause a leak of TCP Connections under stress circumstances (for example having more then 5000 failed connections per minute).
• General - In some cases the system does not free a socket fast enough (for example when you restart the service). An handler for this has been added which retries starting Services like syslog at least for one minute long.
• General - Removed a small and very unlikely memory leak that was caused by disabled actions.

• There was an issue that prevented the "NT Event Type" property to be correctly interpreted.
• There was a bug in the "Send Syslog" action that could cause message text alteration if two or more "Send Syslog" actions were executed for the same message AND message text replacement was used in an action other than the last.
• Two new advanced options have been added to the Event Log Monitor service. They were requested for a specific customer scenario, but could also be generally useful:
  1. Do NOT process existing entries when event log corruption occurs (Event 1011 related)
  2. Do NOT process existing entries on Service Startup
• There was a bug that could lead to registry file corruption if multi-line comments or messages were configured. Only customers working directly with registry files were affected.
• There was a very small memory leak when actions were disabled.