Configuration for monitor Windows syslog

[victor]

Hi!

I don't think it's a 64-bit issue. Could you please post your agent's configuration files? Also, you can try to debug log parser by doing the following:

1. Change agent logging destination to file by setting LogFile = some_file in nxagentd.conf;
2. Add "trace" option to your log parser, like this:

<parser trace="7">

3. Stop agent's service and run agent in debug mode:

nxagentd -c <path_to_nxagentd.conf> -D 9

And watch how parser process events.

Best regards,
Victor

[jonathan.ward]

Hi, thanks for your response.

I have managed to get it working on Win 2003 64-bit overnight, with the same config and agent versions as my 2008 installs.

my current parse file is:
<parser>
  <file>*Application</file>
  <rules>
    <rule>
      <level>3</level>
      <match>(.*)</match>
      <event params="1">100002</event>
    </rule>
  </rules>
</parser>

my agent config is:

#
# NetXMS agent configuration file
# Created by agent installer at Fri Jun 17 17:14:54 2011
#

MasterServers = 192.168.76.199
LogFile = C:\netXMS\nxagentd.log
FileStore = C:\NetXMS\var
SubAgent = ecs.nsm
SubAgent = ping.nsm
SubAgent = logwatch.nsm
SubAgent = portcheck.nsm
SubAgent = winperf.nsm
SubAgent = wmi.nsm
SubAgent = ups.nsm

*LogWatch
Parser = C:\NetXMS\etc\parser_file.xml

I am enabling debugging now and will update with details when I have some! Thanks again

[jonathan.ward]

Within minutes of tracing I have this message:

Call to EvtFormatMessage failed: The specified resource language ID cannot be found in the image file.

This is Windows 2008 Enterprise SP2 English

Thanks in advance...

[jonathan.ward]

i have tried this again on a different server and got this error:

Call to EvtFormatMessage failed: The resource loader failed to find MUI file.

[victor]

Are agent running under local system account or under some user account?

[jonathan.ward]

They are running as Domain Administrator

[victor]

I found the following issue with Windows 2008 SP2: http://support.microsoft.com/kb/2415605. However, it only applies to domain controllers with locale settings other than English United States. Can it be your case?

[jonathan.ward]

This is possible, I will try on some none DC machines however it's primarily for Exchange logging that I want to use the feature

[jonathan.ward]

I have tried installing thew hotfix provided but I'm still getting the same errors

[granadaz]

Hello,
there are some news about this problem?
greatz