How do I alert on when an agent is having issues sending events or has become inactive? (4233915)

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

How do I alert on when an agent is having issues sending events or has become inactive?
Description

There is a need for knowing when Change Auditor Agents go inactive and stop sending events, or stop auditing entirely.
Resolution
When the Coordinator does not receive a heartbeat from an agent within 30 minutes, the "Change Auditor Agent Lost Heartbeat" event is generated. After 24 hours of no heartbeat, the agent is set to inactive. To alert on these events there are 2 options.

1. Set up a third-party tool to monitor the Change Auditor Agent service on each server for if the service stops. (for example: SCOM)
2. Set up an alert in Change Auditor to alert on the following:

Facility: Fault Tolerance

Event Class:
- Change Auditor Agent disconnected.
- Change Auditor Agent lost heartbeat.
- Change Auditor Agent connected.
- Change Auditor Agent restarted.
- Change Auditor Agent started
- Change Auditor Agent stopped
Facility: Change Auditor Internal Auditing

Event Class:
- Agent service has more than 100 events waiting.
- Agent service has reached a critical load.
To create an alert:
1. Open the CA client.
2. Click the Searches tab.
3. Right-click the folder where you want to store the new search/alert and select New Search.
4. Select the 'What' tab of the new search.
5. Click the down arrow next to 'Add' button and select Event Class.
6. Under the Event Class column, click and type "change auditor agent".
7. Select the agent events you want to have alerts for and click Add.
8. Click OK once you have added all the events you would like to use.
9. Select the Alert tab.
10. Click SMTP.
11. In the 'To' field, enter the email address(es) (or click the ellipsis) where you want the alerts sent.
12. Click OK.
13. Click Alert Enabled.
This will allow you to look for lost heartbeats as well as Agent disconnects without connects soon after. In addition, this will alert when the agent service is having issues sending events.

Please note: If you have an older non-Quest branded version of Change Auditor, the folder path will include the non-Quest branded name instead of ‘Quest'.

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Request a KB Article

How do I alert on when an agent is having issues sending events or has become inactive? (4233915)

Title

Description

Resolution

Leave a Comment