<![CDATA[Collecting Windows Event Logs, missing event Source and Event ID]]>Hi,
i have configured simple windows event logging using NetXMS agent nad XML file:

<parser>
<file>*Application</file>
  <rules>
    <rule>
      <level>1</level>
      <match>(.*)</match>
      <event params="1">100002</event>
    </rule>
</parser>

In my Event in Event Template, with message: %1

After I do have some Alarms generation in Event Processing Policy with message %m , etc.

Question is, how can I get more data from Windows Event Log - I am missing "Source" and "Event ID" from Event Log.
Which parameter it is (I have tried %2 and %3 in my Event template but does not work), so how to pull this info into the NetXMS server also?

Thank you

]]>https://forum.netxms.org/topic/3144/collecting-windows-event-logs-missing-event-source-and-event-idRSS for NodeFri, 13 Nov 2026 16:08:08 GMTWed, 07 May 2014 18:20:54 GMT60<![CDATA[Reply to Collecting Windows Event Logs, missing event Source and Event ID on Tue, 27 May 2014 01:08:53 GMT]]>Victor, thank you very much!

]]>https://forum.netxms.org/post/13995https://forum.netxms.org/post/13995Tue, 27 May 2014 01:08:53 GMT<![CDATA[Reply to Collecting Windows Event Logs, missing event Source and Event ID on Mon, 26 May 2014 12:15:22 GMT]]>Hi!

Starting with version 1.2.14 agent appends event source, event ID, and event severity to NetXMS event. Actual position depends on number of capture groups. For example, for rule defined as

    <rule>
      <level>1</level>
      <match>(.*)</match>
      <event params="1">100002</event>
    </rule>

(with 1 capture group) source will be available as %2, event ID as %3, and severity as %4.

Best regards,
Victor

]]>https://forum.netxms.org/post/13993https://forum.netxms.org/post/13993Mon, 26 May 2014 12:15:22 GMT<![CDATA[Reply to Collecting Windows Event Logs, missing event Source and Event ID on Mon, 26 May 2014 09:10:22 GMT]]>hi hksulja, have you found an answer to your question? If so, could you share with us? Thanks!!

]]>https://forum.netxms.org/post/13990https://forum.netxms.org/post/13990Mon, 26 May 2014 09:10:22 GMT