Hi,
We are in the process of investigating is DataMiner restarted on its own or if a user triggered the restart.
For this, I would like to ask your help to identify into which log does the information from this box go to (username/message)?
Thanks in advance,
Carlos
Hi Carlos,
You can track this through the information events in DataMiner.
Building a filter, which filters out the DataMiner Run-time events, will provide you an overview of the restart events.
e.g.
Hi,
Some additional info about restarts of a DMA.
I can think of 4 ways how a DataMiner agent could restart:
- Server reboot: this will not be clearly indicated in the log files. The Watchdog log file will simply show that the agent is starting with “Run Count: 1” mentioned. The “Last Bootup Time” parameter of the Microsoft Platform element that monitors the server could show that when the server last started up. A server could reboot due to a power outage or because of the installation of Windows updates or because of a manual request.
- Executing an upgrade/update that contains a restart action: from C:\Skyline DataMiner\Upgrades\update.log.txt will show the logging of the last time an update has been executed.
- Manual user request: see other answers. If you want to restrict a certain user (group) to restart a DMA then this can be done in the System Center, groups-> permissions-> rights -> Modules -> System Configuration-> Agents that contains the rights to “(Re)Start”, “Stop”, “Shutdown”, or “Reboot” an agent. In my personal opinion nobody should have the security right to “Stop” a DMA or “Shutdown” a server in an operational environment enabled all the time, this right should be disabled to avoid clicking on it by accident. If it is really needed then the right can temporary be enabled.
- Crash of one of the processes that triggered an automatic restart: can be seen by going to C:\Skyline DataMiner\Logging\SLWatchdog2_BAK.txt logfile and potential presence of crashdump files under C:\Skyline DataMiner\Logging\CrashDump . The logfile will mention if a process disappearance happened. Do note that restarting an agent again will overwrite this file so it’s not possible to investigate older occurrences
Hi Carlos, this information is stored into the information event that is created when calling for a DataMiner restart. The username and message is displayed into the information event.
Thank you very much Leander!
To add to the previous answers, SLWatchdog will also save this information to the Windows Event Logs. When opening the Windows Event viewer, open the ‘Dataminer‘ log under ‘Applications and Services Logs‘. Filter on EventID 17 to find out who stopped DataMiner, filter on EventID 18 to find out who started it.
Thanks a lot Ive!