<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Windows EventLog handling error...]]></title><description><![CDATA[<p dir="auto">Hello,</p>
<p dir="auto">----------------------------<br />
Current: .\src\agent\subagents\logwatch\eventlog.cpp is unable<br />
to handle any other event log beside *System.</p>
<p dir="auto">parser definition &lt;file&gt;*Security&lt;/file&gt; for instance will try<br />
to get EventMessageFile value from registry on path:</p>
<p dir="auto">HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\Security<br />
----------------------------</p>
<p dir="auto">----------------------------<br />
&lt;file&gt;*Application&lt;/file&gt;</p>
<p dir="auto">should handle:<br />
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application<br />
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\&lt;XY Application&gt;<br />
----------------------------</p>
<p dir="auto">----------------------------<br />
Could someone pretty please fix that and attach compiled logwatch.nsm<br />
for v0.2.26.1 until next release.</p>
<p dir="auto">Curent fix (for impatient grateful users) is to copy:<br />
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security\Security<br />
to<br />
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\System\Security</p>
<p dir="auto">for *Application hover you must copy relavant subkey of<br />
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\&lt;xyz&gt;<br />
to<br />
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\System\&lt;xyz&gt;<br />
----------------------------</p>
<p dir="auto">thank you,</p>
<p dir="auto">Ales</p>
]]></description><link>https://forum.netxms.org/topic/660/windows-eventlog-handling-error...</link><generator>RSS for Node</generator><lastBuildDate>Fri, 13 Nov 2026 06:36:59 GMT</lastBuildDate><atom:link href="https://forum.netxms.org/topic/660.rss" rel="self" type="application/rss+xml"/><pubDate>Fri, 19 Jun 2009 08:24:31 GMT</pubDate><ttl>60</ttl><item><title><![CDATA[Reply to Windows EventLog handling error... on Sun, 21 Jun 2009 13:23:41 GMT]]></title><description><![CDATA[<p dir="auto">Hello!</p>
<p dir="auto">In fact, we need completely different log readers for Windows Vista and 2008 - Microsoft changes event log API (see <a href="http://msdn.microsoft.com/en-us/library/aa964766(vs.85).aspx" rel="nofollow ugc">http://msdn.microsoft.com/en-us/library/aa964766(vs.85).aspx</a>), and old API used by logwatch.nsm is not always compatible with new logs. I'll add support for new event log API in upcoming release.</p>
<p dir="auto">Best regards,<br />
Victor</p>
]]></description><link>https://forum.netxms.org/post/3140</link><guid isPermaLink="true">https://forum.netxms.org/post/3140</guid><dc:creator><![CDATA[victor]]></dc:creator><pubDate>Sun, 21 Jun 2009 13:23:41 GMT</pubDate></item><item><title><![CDATA[Reply to Windows EventLog handling error... on Sun, 21 Jun 2009 09:21:50 GMT]]></title><description><![CDATA[<p dir="auto">Sory, environment is:</p>
<ul>
<li>windows 2008 x64 server</li>
<li>x64 v0.2.26.1 agent</li>
</ul>
<p dir="auto">Error was checked with Process Monitor v2.04<br />
<a href="http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx" rel="nofollow ugc">http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx</a></p>
<p dir="auto">Filtering was set to show nxagentd.exe Process Name and<br />
all failed registry query requests begining with path<br />
HKLM\System\CurrentControlSet\Services\Eventlog</p>
<p dir="auto">Ales</p>
]]></description><link>https://forum.netxms.org/post/3139</link><guid isPermaLink="true">https://forum.netxms.org/post/3139</guid><dc:creator><![CDATA[sodalist]]></dc:creator><pubDate>Sun, 21 Jun 2009 09:21:50 GMT</pubDate></item></channel></rss>