<![CDATA[Windows Event Log parser]]>Hi!
I have 3 questions.
I have a parser file hereunder:

<parser>
  <file>*Application</file>
  <rules>
    <rule>
      <match>(.*)</match>
      <id>5</id>
    </rule>
    <rule>
      <match>(.*)</match>
      <id>1006</id>
    </rule>
    <rule>
      <match>(.*)</match>
      <id>1008</id>
    </rule>
    <rule>
      <match>(.*)</match>
      <id>1023</id>
    </rule>
    <rule>
      <match>(.*)</match>
      <id>1057</id>
    </rule>
    <rule>
      <match>(.*)</match>
      <id>12014</id>
    </rule>
    <rule>
      <match>(.*)</match>
      <level>1</level>
      <event params="1">100003</event>
    </rule>
  </rules>
</parser>

1:
Is there a simpler method to exclude events with predefined event id? (e.g.: 5,1006,1008,...)

2:
I manage Windows 7, Windows Server 2008 and Windows Server 2012, and i see that the severity levels are the following:
Critical =1
Error=2
Warning =3
Information=4

The above example captures only Windows error level events. How to set the <level> parameter to capture Windows critical events? (And, of course, how to combine the values?)

3:
With the above parser, the agent always misses the event with event id 1. What could be the reason?

]]>https://forum.netxms.org/topic/3437/windows-event-log-parserRSS for NodeFri, 13 Nov 2026 11:19:10 GMTTue, 28 Oct 2014 16:38:30 GMT60<![CDATA[Reply to Windows Event Log parser on Wed, 29 Apr 2015 08:23:23 GMT]]>Hi,

I've added additional level mask 256 to match critical events.

Best regards,
Victor

]]>https://forum.netxms.org/post/16669https://forum.netxms.org/post/16669Wed, 29 Apr 2015 08:23:23 GMT<![CDATA[Reply to Windows Event Log parser on Mon, 13 Apr 2015 06:51:17 GMT]]>Hi,

would be nice if you registered it as feature request - then it will not be forgotten again 🙂 I will schedule it for next release.

Best regards,
Victor

]]>https://forum.netxms.org/post/16385https://forum.netxms.org/post/16385Mon, 13 Apr 2015 06:51:17 GMT<![CDATA[Reply to Windows Event Log parser on Sat, 11 Apr 2015 14:01:38 GMT]]>For which version of NetXMS is this scheduled now? (capturing Windows Critical level events) Or should I register a feature request?

]]>https://forum.netxms.org/post/16378https://forum.netxms.org/post/16378Sat, 11 Apr 2015 14:01:38 GMT<![CDATA[Reply to Windows Event Log parser on Tue, 18 Nov 2014 21:44:26 GMT]]>Hi,

unfortunately you problem cannot be solved by configuration. We will need to make changes in log monitoring subagent, so you'll have to wait for release with a fix.

Best regards,
Victor

]]>https://forum.netxms.org/post/15356https://forum.netxms.org/post/15356Tue, 18 Nov 2014 21:44:26 GMT<![CDATA[Reply to Windows Event Log parser on Mon, 17 Nov 2014 10:50:47 GMT]]>Excuse me, but my above problem is outstanding. Could anybody help me to resolve this?

]]>https://forum.netxms.org/post/15334https://forum.netxms.org/post/15334Mon, 17 Nov 2014 10:50:47 GMT<![CDATA[Reply to Windows Event Log parser on Mon, 10 Nov 2014 14:06:48 GMT]]>In the documentation there are these "levels":
1 Error
2 Warning
4 Information
8 Audit Success
16 Audit Failure
These levels are in Windows XP.

But there isn't Critical, like in Windows 7 and above versions. As I wrote, in Windows 7 (and above) the levels are:
1 Critical
2 Error
3 Warning
4 Information

So, how to combine the NetXMS levels for capturing Windows Critical level events?

To help clarify my problem, I insert the link of TechNet documentation about Windows Event Properties:
http://technet.microsoft.com/en-us/library/cc765981.aspx

Thanks for your answers!

]]>https://forum.netxms.org/post/15261https://forum.netxms.org/post/15261Mon, 10 Nov 2014 14:06:48 GMT<![CDATA[Reply to Windows Event Log parser on Tue, 04 Nov 2014 09:36:24 GMT]]>@farcsa said in Windows Event Log parser:

1:
Is there a simpler method to exclude events with predefined event id? (e.g.: 5,1006,1008,...)

not really - you can specify ID range in one rule, like <id>1001-1099</id>, but that will not help if you have non-adjacent IDs to ignore.

@farcsa said in Windows Event Log parser:

2:
I manage Windows 7, Windows Server 2008 and Windows Server 2012, and i see that the severity levels are the following:
Critical =1
Error=2
Warning =3
Information=4

The above example captures only Windows error level events. How to set the <level> parameter to capture Windows critical events? (And, of course, how to combine the values?)

combining codes described here: https://www.netxms.org/documentation/adminguide/log-monitoring.html#level-tag

@farcsa said in Windows Event Log parser:

3:
With the above parser, the agent always misses the event with event id 1. What could be the reason?

In the parser I don't see specific rule for DI 1, so it can only be caught by last rule by severity. Are you sure that severity for this event is "Error"?

Best regards,
Victor

]]>https://forum.netxms.org/post/15200https://forum.netxms.org/post/15200Tue, 04 Nov 2014 09:36:24 GMT