Parsing windows event logs and generating alarms

[Egert143]

Hello

I am experimenting with logging and alerting on windows event logs. Logging part works, i would like to get little example on event 4625 (Failed account log on), how to generate alarm that contains user and source ip that tried to log in.

Egert

[Filipp Sudanov]

As I remember, this information might be present in parameters of that event. If you open Event Log in NetXMS, find such event there and double-click it, a window should open with event details. Please share it here

[Egert143]

So far i have the following:

[Filipp Sudanov]

Right, looks like you are using Windows Event Log synchronization.

But how do details of NetXMS event "Win Event - Failed account log on" look in NetXMS event log?

[Egert143]

I added image how event log displays it.

Also i am thinking it needs to be parsed similarly to syslog but since windows event logs are so big, surely there is better way then to include entire log in one line and add "(.)" where required info is.

[Filipp Sudanov]

On your screenshot it's Event Monitor (which is updated in real-time). If you find this event in Event Log and double-click on it, you should have something like this:

---

[Egert143]

Under Logs -> Events i found the event, but its missing alot of info:

[Filipp Sudanov]

In my example event was generated by Event Log Parser on agent, by adding a Log Parser Policy. In case of Win Event Sync there's less information available.

[Egert143]

Could i get litle demo how to achive the same alerting with Log parser policy?

[Filipp Sudanov]

Sure, here's a couple of screenshots. First is log parser policy, file name is *Security which means that it's reading Security windows event log. It's picking only records with ID = 4624. Matching regular expression is .*, we can also use capture groups here, at maximum we can just put (.*), but this will pick the whole multi-line event description. Capture groups, if any, will also go as NetXMS event parameters.

On second screenshot we have event template. Message field describes which event parameters we use to compose the message - it's better to use parameter names instead of %1, %2, as number of parameters may change, e.g. if we add a new capture group, but names will stay the same.

Remember, that you need to apply the template to a node for this to start working.

---

[Egert143]

Do i still need to update Agent Conf file also ?, Currently i dont see any events with dooing just the above steps.

[Filipp Sudanov]

[color=#404040][size=2][font=SFMono-Regular, Menlo, Monaco, Consolas, Liberation Mono, Courier New, Courier, monospace][color=#4070a0]SubAgent[/color] [color=#666666]=[/color] [color=#4070a0]logwatch[/color][/font][/size][/color]

is needed in agent config