Windows EventLog parsing questions

[user54119]

Hi Victor

Here the agent log with debuglevel=2. There was no "LogWatch: EvtQuery failed (...)".
There were these events for example before the NetXMS agent started:
Event-ID 41, Source=Kernel-Power, severity=critical, 04.05.2015 18:19:34
Event-ID 6008, Source=EventLog, severity=error, 04.05.2015 18:19:36

thanks
Dani

---

nxagentd-debug2.log

[user54119]

Hi Victor

Have you found anything about this?

thanks
Dani

[user54119]

Have you found anything in the debug log file?

[flytech-ben]

Hello Victor,

is it possible to add the user name of the Windows event log entry to the event parameters?
I monitor a terminal server farm for application crashes which works really nice, but I like to know in the event which user session is affected.

Greetings
Ben

[user54119]

Are there any news about the offline processing feature? In V2.0-RC2 it's still not working for us.

[victor]

It works on all my (very limited) set of Windows systems (test it on Win XP, Win 7, and Win 10). Do you have it working on at least one system?

Best regards,
Victor

[user54119]

Hi Victor

Very strange. I have tested with a Win7, a Win8.1 and a Win2012R2 node. All with the same negative result.
How did you tested?

My test was like this:

Logwatch section of the agent config:

[logwatch]
ProcessOfflineEvents = yes
Parser = ${ProgramFiles}\NetXMS\var\eventlog-system-parser.xml
Parser = ${ProgramFiles}\NetXMS\var\eventlog-application-parser.xml

Parser (file: eventlog-system-parser.xml):

<parser name="SystemLog">
  <file>*System</file>
  <rules>
    <rule>
      <match>(.*)</match>
      <level>1</level>
      <event params="1">100845</event>
    </rule>
  </rules>
</parser>

Than I hard-switched of the node. After that I checked the NetXMS events of this node. But I can't find any event for the expected Windows Event (Eventlog: System, Event-ID: 6008, Source: Eventlog, Text: Last shutdown was unexpected).
While normal operation I get a NetXMS event for every error in Windows Eventlog. I only have problems with offline events.

thanks
Dani