I am wondering if anyone has successfully generate alert from SharePoint LOGBinder logs. I tried to created a view,
1) Create View -TestLOGBinder
2) Select the SharePoint Server
3) Add Filter
- WHERE Type IN 'Microsoft SharePoint'
4) Click apply
5) Select Message ID 48 (for testing purpose, this message ID generate the most logs)
==========
48
<@fld61:*PARMVAL(event_user)><@event_time:*EVNTTIME($MSG,'%B %F %W %N:%U:%O',fld41,fld42,fld44,fld43)><@recorded_time:*EVNTTIME($MSG,'%G/%F/%W %N:%U:%O %P',fld45,fld46,fld47)><@msg:*PARMVAL($MSG)><event_log>,<fld5>,<fld40> <fld41> <fld42> <fld43> <fld44>,<event_id>,<event_source>,<event_user>,<event_type>,<event_computer>,<category>,<data>,<action>%rOccurred: <fld45> <fld46> <fld47>%rSite: <url>%rUser: <username>%rObject%r URL: <webpage>%r Title: <directory>%r Description: <info>
==========
6) Left the next 2 screen in default and click Finished.
The view restart and status show it's running
I then go to the Analysis tab, eventually I'll have the following logs from LOBGinder
==========
%NICWIN-4-LOGbndSP_48_LOGbndSP: LOGbndSP,rn=17191 cid=0x00000002 eid=0x00000030,Wed Jun 20 09:56:13 2012,48,LOGbndSP,None,Success Audit,server.domain,SharePoint,,Document library viewed%rOccurred: 6/20/2012 9:56:01 AM %rSite: http://sharepointsite %rUser: username %rObject%r URL: /location/site.aspx %r Title: Pages %r Description: This system library was created by the Publishing feature to store pages that are created in this site. %r%rFor more information, see http://logbinder.com/support
==========
I then go to check the Real-time Detail for TestLOGBinder, everything are still 0. The default alert level for message ID 48 is Level 7 (actually all 50 message ID from LOGBinder has default alert level 7). Is this the reason why I am not getting alert because the alert level is at the lowest? I tried to change it to a higher custom alert level but it does not help.
Thanks for reading. Comments and ideas are much appreciated.
