Thx for the anserws, can you please be more specific regarding answer one, so you're sure it can be done only having snare agent on th machine? from where do I set it?

Well, I can't say if it's possible to trigger a log event via MS-RPC, as I haven't used that particular method of management.  It merely seemed logical that SNARE would be a possible solution.  But, no, I can't really explain it in detail, as I don't have any time actually using the SNARE client.  I'm done implementations where a few devices were reporting via SNARE, but that's about it.

I was really basing my comment off of the general nature of what you were looking for - changing a single text file seems fairly specific, innocuous, and usually insignificant that I wouldn't imagine a pre-defined event would exist for it.  I would imagine that even if one did, it would at least have to be tuned to point at the specific text file that needs to be monitored.  Probably best to check the SNARE documentation at the client's website:

Guide to Snare for Windows and Windows Vista (intersectalliance.com - PDF document)

Best of luck.

DEar Micheal

Thanks for your answers! Concerning the monitoring of MARS processes, and since snmp is not a supported monitoring way, isn't there another way.

One of our customer's box services are down and he needs a way to monitor the service.

I thought of monitoring the ports of each service; After manually shutting the service via CLI and bringing it up I noticed that the udp port 1500 and above are used for some of the services but it didn't work. any hints?

Regards