reset wmi performance counter \\System\\Error Login

[hohum]

Hi,

I have a critical on "Logon Errors"

$USER1$/check_nt -H $HOSTADDRESS$ -s "$ARG1$" -p 12489 -v $ARG2$ $ARG3$ $ARG4$

$ARG1$ = password-not telling
$ARG2$ = COUNTER
$ARG3$ = -l "\\Server\\Errors Logon","Login Errors since last reboot is %.f" -w 2 -c 20

There's been 395 login errors since last reboot. This is a fantastic monitor. But I'd like to be able to reset the counter to clear the alert without rebooting. That doesn't sound possible. Am I right? Google is not helping.

- Marc

[sreinhardt]

Unfortunately short of rebooting or resetting all performance counters on the system back to their base values, there is not much if anything that I know of to reset an individual counter. The one or two things I do know of, I would not suggest using on a production box. Might this be something you would be better off writing a wrapper script to store the last value(s) and compare with a difference between the two checks?