We had noticed that after testing and removing a few filter settings, we were missing events in Web Access. After some investigation, I had the impression that one of the filters we had tested was somehow "stuck" in the application.
We had tested changes on Feb 6th
Service restarted
Changes were reverted on Feb 6th
Service Restarted
Updates were applied to the server on Feb 25th
Server restarted.
Unfortunately - because we're boneheads - we didn't notice that we were missing events from Web Access until March 1st; mainly because the two of us who most frequently configure the application actually hide these events from our screen anyway. Since it was brought to our attention, I have made several changes to the Setup of Kiwi Syslog Server.
- Rules
- Filters
- Actions
- Email server settings
Service has been restarted dozens of times and server has been restarted twice; after repeated attempts, none of the revised settings are reflected in the application.
At one point, I was resigned to having to reinstall the software - this installation isn't that heavily customized, so it wouldn't have been too much of an imposition. In any event, I exported the settings to an INI file for easy recovery after the re-installation. When reviewing the resulting INI file, I had noticed that there were one or two "hidden" filters that were in the file that were not showing in the setup. These filters actually explained why several events were missing from Web Access. If it is pertinent, the offending filters were using complex and RegExp filters on the Message Text field.
I attempted to manually modify the INI file and re-import it; no change. A subsequent export still listed the filters. I actually tried several different modifications of the original INI export in an attempt to rectify the problem - nothing appeared to work.
There are several instances of a DCOM (DistributedCOM) error EventID 10000 in the System log, but these stretch back to before the changes were first made - I include this for reference:
Unable to start a DCOM Server: {1C546A70-60EF-4431-B4FC-D6741E20E815}. The error:
"740"
Happened while starting this command:
E:\Program Files (x86)\Syslogd\Syslogd_TaskEngine.exe -Embedding
There are also a couple of Error events in the SolarWinds.Net event log Event Id 0 with text that match or are substantially similar to the following, but they, too, stretch back to before the changes:
System.Web
System.Web.HttpRequest
System.Web.HttpUnhandledException: Exception of type 'System.Web.HttpUnhandledException' was thrown. ---> System.NullReferenceException: Object reference not set to an instance of an object.
at _Event.Page_Load(Object sender, EventArgs e)
at System.Web.UI.Control.OnLoad(EventArgs e)
at System.Web.UI.Control.LoadRecursive()
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
--- End of inner exception stack trace ---
at System.Web.UI.Page.HandleError(Exception e)
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
at System.Web.UI.Page.ProcessRequest()
at System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context)
at System.Web.UI.Page.ProcessRequest(HttpContext context)
at ASP.events_aspx.ProcessRequest(HttpContext context)
at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
So, before I continue the wipe and reinstall, is this something that somebody has come across before? Are there any workarounds or resolutions? Is there any advice? I'd prefer not to reinstall, because I'll have to redo all of the rules/filters/actions from scratch (for fear there is something nasty in the INI that is related to this trouble).