What does event 1011 mean?
Our MonitorWare Line of Products e.g. EventReporter, MonitorWare Agent etc. periodically reads the Windows Event Log. While reading the Windows Event Log, they try to read the last record that was processed in the last run. We had opt for this, because if the last record doesn’t exist, then either someone had messed up with the Windows Event Log or the Windows Event Log was truncated. When MonitorWare Line of Products can not read the last record, then two things happen:
- MonitorWare Line of Products send an Event ID 1011 to the Application Event Log stating that the Log has been truncated (this can be disabled by unchecking the “Report Log Truncation” checkbox in the configuration program).
- MonitorWare Line of Products re-set the counter to the begining of the Windows Event Log.
Number 2 is done because there is no better way to resume processing, especially when the last record could not be found (it would be guessing where to begin). Please note that this can lead to message duplication.
This condition is normal when someone has cleared the event log in question. However, if that is not the case, seeing an 1011 event is a good indication that somebody has messed up with the event logs.
If you receive multiple 1010 events and you know this is fine based on your configuration, you may want to look at our step-by-step guide to limiting the number of consecutive events received.