Collecting Windows Event Logs, missing event Source and Event ID

[hkusulja]

Hi,
i have configured simple windows event logging using NetXMS agent nad XML file:

<parser>
<file>*Application</file>
  <rules>
    <rule>
      <level>1</level>
      <match>(.*)</match>
      <event params="1">100002</event>
    </rule>
</parser>

In my Event in Event Template, with message: %1

After I do have some Alarms generation in Event Processing Policy with message %m , etc.

Question is, how can I get more data from Windows Event Log - I am missing "Source" and "Event ID" from Event Log.
Which parameter it is (I have tried %2 and %3 in my Event template but does not work), so how to pull this info into the NetXMS server also?

Thank you

[pedrong]

hi hksulja, have you found an answer to your question? If so, could you share with us? Thanks!!

[victor]

Hi!

Starting with version 1.2.14 agent appends event source, event ID, and event severity to NetXMS event. Actual position depends on number of capture groups. For example, for rule defined as

    <rule>
      <level>1</level>
      <match>(.*)</match>
      <event params="1">100002</event>
    </rule>

(with 1 capture group) source will be available as %2, event ID as %3, and severity as %4.

Best regards,
Victor

[pedrong]

Victor, thank you very much!