Windows EventLog parsing questions

[user54119]

thanks for the update, ok for me.

[victor]

Hi,

#2 is implemented in 1.2.17. This is turned off by default to maintain compatibility with previous versions. Setting parameter ProcessOfflineEvents in LogWatch section to yes or true will enable this feature. When on, agent will save timestamp of last processed event and on start will process all events since last processed.

Best regards,
Victor

[user54119]

Hi Victor

I come back to #2 and #4:

#2: I tested again with V2.0.-M3 but it is not working for me. Can you please check again?

#4: For which version is this planned?

Thanks, Dani

[victor]

Hi,

can you please show me your agent config and content of registry entries under HKEY_USERS\.DEFAULT\Software\NetXMS\LogParserLibrary (assuming you run agent under Local System account - otherwise check same registry path under appropriate user)?

Best regards,
Victor

[user54119]

agent config (put together from server agent configuration and agent policy):

MasterServers = netxms.domain.com
ListenPort = 4700
RequireAuthentication = yes
RequireEncryption = yes
EnabledCiphers = 1
SharedSecret = longkey
EnableWatchdog = yes
LogFile = {syslog}
LogFile = ${ProgramFiles}\NetXMS\nxagentd.log
DebugLevel = 0
ConfigIncludeDir = ${ProgramFiles}\NetXMS\etc\nxagentd.conf.d
FileStore = ${ProgramFiles}\NetXMS\var
SubAgent = ecs.nsm
SubAgent = portcheck.nsm
SubAgent = ping.nsm
SubAgent = winperf.nsm
SubAgent = wmi.nsm
SubAgent = logwatch.nsm
SubAgent = filemgr.nsm

[filemgr]
RootFolder = ${SystemDrive}\

[logwatch]
ProcessOfflineEvents = yes
Parser = ${ProgramFiles}\NetXMS\var\eventlog-system-parser.xml
Parser = ${ProgramFiles}\NetXMS\var\eventlog-application-parser.xml

Registry Key HKEY_USERS\.DEFAULT\Software\NetXMS\LogParserLibrary:

LogWatch.Application REG_DWORD 0x552b7a44
LogWatch.System REG_DWORD 0x552b7a78

[user54119]

Have you found anything in my config and the registry?

[user54119]

Hi Victor.
Have you found anything in my config and the registry?

thanks
Dani

[victor]

Hi,

it looks perfectly fine. I re-run tests on my system, and agent picks up everything as expected. Let's try to upgrade this system to 2.0-M4 (just to make sure I'm checking latest codebase) , and if it will not help I'll create special build with additional debug.

Best regards,
Victor

[user54119]

Ok, I will try V2.0-M4 first. When will it be available?

[victor]

It's just made available for download.

Best regards,
Victor

[user54119]

I have updated to V2.0-M4, but I see the same issue as before.

I tested like this:

parser xml:

<parser name="SystemLog">
  <file>*System</file>
  <rules>
    <rule>
      <match>(.*)</match>
      <level>1</level>
      <event params="1">100845</event>
    </rule>
  </rules>
</parser>

I turned off hardly a Win7-x64 virtual machine and started again. But I don't get an event '100845' in NetXMS for the windows error 6008 (last shutdown was unexpected) in the system eventlog.

Other windows events while the node is normal working are parsed ok and generate NetXMS events.

[victor]

Can you please set debug level to at least 2, reset system again, and check agent's log for message like

LogWatch: reading old events between ... and ...

and possibly also like this:

LogWatch: EvtQuery failed (...)

and post those lines and timestamp of "unexpected shutdown" event.

Best regards,
Victor

[user54119]

Hi Victor

Here the agent log with debuglevel=2. There was no "LogWatch: EvtQuery failed (...)".
There were these events for example before the NetXMS agent started:
Event-ID 41, Source=Kernel-Power, severity=critical, 04.05.2015 18:19:34
Event-ID 6008, Source=EventLog, severity=error, 04.05.2015 18:19:36

thanks
Dani

---

nxagentd-debug2.log

[user54119]

Hi Victor

Have you found anything about this?

thanks
Dani

[user54119]

Have you found anything in the debug log file?

[flytech-ben]

Hello Victor,

is it possible to add the user name of the Windows event log entry to the event parameters?
I monitor a terminal server farm for application crashes which works really nice, but I like to know in the event which user session is affected.

Greetings
Ben

[user54119]

Are there any news about the offline processing feature? In V2.0-RC2 it's still not working for us.

[victor]

It works on all my (very limited) set of Windows systems (test it on Win XP, Win 7, and Win 10). Do you have it working on at least one system?

Best regards,
Victor

[user54119]

Hi Victor

Very strange. I have tested with a Win7, a Win8.1 and a Win2012R2 node. All with the same negative result.
How did you tested?

My test was like this:

Logwatch section of the agent config:

[logwatch]
ProcessOfflineEvents = yes
Parser = ${ProgramFiles}\NetXMS\var\eventlog-system-parser.xml
Parser = ${ProgramFiles}\NetXMS\var\eventlog-application-parser.xml

Parser (file: eventlog-system-parser.xml):

<parser name="SystemLog">
  <file>*System</file>
  <rules>
    <rule>
      <match>(.*)</match>
      <level>1</level>
      <event params="1">100845</event>
    </rule>
  </rules>
</parser>

Than I hard-switched of the node. After that I checked the NetXMS events of this node. But I can't find any event for the expected Windows Event (Eventlog: System, Event-ID: 6008, Source: Eventlog, Text: Last shutdown was unexpected).
While normal operation I get a NetXMS event for every error in Windows Eventlog. I only have problems with offline events.

thanks
Dani