<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Logwatch - i must be missing something]]></title><description><![CDATA[<p dir="auto">Trying to get a logwatch on a custom Eventlog (Server 2003) and no matter what I try I can't seem to get it to work. I'm sure I'm missing something obvious.</p>
<p dir="auto">MasterServers = 10.32.3.49<br />
LogFile = {syslog}<br />
FileStore = C:\NetXMS\var<br />
SubAgent = ecs.nsm<br />
SubAgent = ping.nsm<br />
SubAgent = portcheck.nsm<br />
SubAgent = winperf.nsm<br />
SubAgent = wmi.nsm<br />
SubAgent = logwatch.nsm</p>
<p dir="auto">*LOGWATCH<br />
Parser = C:\NetXMS\tvdevicefail.xml</p>
<p dir="auto">............................</p>
<p dir="auto">&lt;parser&gt;<br />
&lt;file&gt;C:\WINDOWS\System32\config\TVEvent.evt&lt;/file&gt;<br />
&lt;rules&gt;<br />
    &lt;rule&gt;<br />
    &lt;match&gt;*&lt;/match&gt;<br />
    &lt;id&gt;137&lt;/id&gt;<br />
    &lt;level&gt;2&lt;/level&gt;<br />
    &lt;source&gt;Televantage&lt;/source&gt;<br />
    &lt;event&gt;100065&lt;/event&gt;<br />
    &lt;/rule&gt;<br />
        &lt;rule&gt;<br />
        &lt;match&gt;*&lt;/match&gt;<br />
        &lt;id&gt;106&lt;/id&gt;<br />
        &lt;level&gt;4&lt;/level&gt;<br />
        &lt;source&gt;Televantage&lt;/source&gt;<br />
        event&gt;100066&lt;/event&gt;<br />
        &lt;/rule&gt;<br />
&lt;/rules&gt;<br />
&lt;/parser&gt;</p>
<p dir="auto">I can generate automatically the 2nd event, but no matter what I try, I don't seem to receive it in NetXMS. Am I missing something very obvious, does it have to set up a DCI? If so, what on earth would the parameters be?</p>
<p dir="auto">Thanks once agian guys and keep up the good work.</p>
]]></description><link>https://forum.netxms.org/topic/1501/logwatch-i-must-be-missing-something</link><generator>RSS for Node</generator><lastBuildDate>Fri, 13 Nov 2026 17:50:43 GMT</lastBuildDate><atom:link href="https://forum.netxms.org/topic/1501.rss" rel="self" type="application/rss+xml"/><pubDate>Fri, 16 Dec 2011 15:17:18 GMT</pubDate><ttl>60</ttl><item><title><![CDATA[Reply to Logwatch - i must be missing something on Fri, 16 Dec 2011 15:40:13 GMT]]></title><description><![CDATA[<p dir="auto">Also, I suppose that you have to use custom event log name, not a full path to actual .evt file. If I understand correctly, all available logs are listed in registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog. But I never works with custom Windows event logs, so I may be wrong.</p>
<p dir="auto">Best regards,<br />
Victor</p>
]]></description><link>https://forum.netxms.org/post/6491</link><guid isPermaLink="true">https://forum.netxms.org/post/6491</guid><dc:creator><![CDATA[victor]]></dc:creator><pubDate>Fri, 16 Dec 2011 15:40:13 GMT</pubDate></item><item><title><![CDATA[Reply to Logwatch - i must be missing something on Fri, 16 Dec 2011 15:34:06 GMT]]></title><description><![CDATA[<p dir="auto">Hi!</p>
<p dir="auto">If you give file name in &lt;file&gt; tag, logwatch subagent will threat it as regular text file, which I suppose is not the case. If you need to openWindows event log, you must prepend it's name with asterisk, like &lt;file&gt;*System&lt;/file&gt;. And you have missing opening angle bracket in second rule, maybe just a copy/paste error.</p>
<p dir="auto">Best regards,<br />
Victor</p>
]]></description><link>https://forum.netxms.org/post/6490</link><guid isPermaLink="true">https://forum.netxms.org/post/6490</guid><dc:creator><![CDATA[victor]]></dc:creator><pubDate>Fri, 16 Dec 2011 15:34:06 GMT</pubDate></item></channel></rss>