<![CDATA[Logwatch Error with NetXMS 0.2.31 on Windows 2008 64bit]]>Hi,

I have upgraded our systems with the NetXMS Agent version 0.2.31. So far no issues, BUT:
Monitoring Windws Event Log's on Windows 2008 64bit systems stoped working.
Note: in earlier releases we where only able to install the 32bit version on 64bit systems. (64bit agent gave us errors during install)
With version 0.2.31 this seems to be fixed, but the errors are indicating that ther may be something wrong with the 64bit agent distribution.
Wondering if anybody else had/has this issue?

I added the trace="1" to the parser section and started the agend in debug mode (with the -D flag) and that's the result in the debug log:

[03-Dec-2009 15:19:19] Debug: LogWatch: registered parser for file *System, trace level set to 1
[03-Dec-2009 15:19:19] Debug: LogWatch: Start watching event log "System" (using EvtSubscribe)
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent

]]>https://forum.netxms.org/topic/781/logwatch-error-with-netxms-0.2.31-on-windows-2008-64bitRSS for NodeFri, 13 Nov 2026 08:36:36 GMTThu, 03 Dec 2009 14:28:21 GMT60<![CDATA[Reply to Logwatch Error with NetXMS 0.2.31 on Windows 2008 64bit on Thu, 03 Jun 2010 06:49:55 GMT]]>Hi Victor!

I did the following:

C:\NetXMS\bin>nxagentd.exe -R
Win32 Agent service deleted successfully
Event source "NetXMS Win32 Agent" uninstalled successfully

C:\NetXMS\bin>nxagentd.exe -I -c "C:\NetXMS\etc\nxagentd.conf"
Service "NetXMSAgentdW32" created successfully
Event source "NetXMS Win32 Agent" installed successfully

Unfortunately it is still not working. I did try it as well with the 0.2.31 Version and the "fixed" logwatch.nsm go created once, but strangly it is as well not working. 😞

]]>https://forum.netxms.org/post/4244https://forum.netxms.org/post/4244Thu, 03 Jun 2010 06:49:55 GMT<![CDATA[Reply to Logwatch Error with NetXMS 0.2.31 on Windows 2008 64bit on Wed, 02 Jun 2010 16:24:26 GMT]]>Hi!

Unfortunately no. I cannot reproduce this problem nor find any useful information about this error. Interesting thing is that from the trace ("LogWatch: publisher name is NetXMS Win32 Agent") we can see that agent fails on formatting it's own messages. Is it always the case? If yes, could you try to reinstall agent's service on problematic machine with the following commands:

nxagentd.exe -R
nxagentd.exe -I -c <full+path_to_config_file>

Best regards,
Victor

]]>https://forum.netxms.org/post/4241https://forum.netxms.org/post/4241Wed, 02 Jun 2010 16:24:26 GMT<![CDATA[Reply to Logwatch Error with NetXMS 0.2.31 on Windows 2008 64bit on Wed, 02 Jun 2010 08:51:07 GMT]]>Hi Victor,

any news/ideas on this issue?

Kind Regards

]]>https://forum.netxms.org/post/4239https://forum.netxms.org/post/4239Wed, 02 Jun 2010 08:51:07 GMT<![CDATA[Reply to Logwatch Error with NetXMS 0.2.31 on Windows 2008 64bit on Tue, 25 May 2010 09:38:47 GMT]]>Hi Victor

It's a english version. I checked with the other systems where logwatch is working, and the only thing which was different, that for non-unicode regional settings the one which gives us problems the location was set to german-switzerland. I changed this to english, but no success.

]]>https://forum.netxms.org/post/4234https://forum.netxms.org/post/4234Tue, 25 May 2010 09:38:47 GMT<![CDATA[Reply to Logwatch Error with NetXMS 0.2.31 on Windows 2008 64bit on Tue, 25 May 2010 09:33:09 GMT]]>Do you use English version of Windows or localized one?

Best regards,
Victor

]]>https://forum.netxms.org/post/4232https://forum.netxms.org/post/4232Tue, 25 May 2010 09:33:09 GMT<![CDATA[Reply to Logwatch Error with NetXMS 0.2.31 on Windows 2008 64bit on Tue, 25 May 2010 07:26:04 GMT]]>After Upgrading to the latest available release (1.1.0-rc11) Logwatch stoped working on some systems.
When I trace I get the following errors in the debug log:

LogWatch: publisher name is NetXMS Win32 Agent
LogWatch: Call to EvtFormatMessage failed: The specified resource language ID cannot be found in the image file.

Any ideas why?

Kind Regards

Nikos

]]>https://forum.netxms.org/post/4230https://forum.netxms.org/post/4230Tue, 25 May 2010 07:26:04 GMT<![CDATA[Reply to Logwatch Error with NetXMS 0.2.31 on Windows 2008 64bit on Mon, 07 Dec 2009 07:33:46 GMT]]>Dear Victor

Works perfect now!
What should I say..... your support and response time was BRILLIANT once AGAIN!
Many, many thanks for that!
Have a great week and kind regards

]]>https://forum.netxms.org/post/3687https://forum.netxms.org/post/3687Mon, 07 Dec 2009 07:33:46 GMT<![CDATA[Reply to Logwatch Error with NetXMS 0.2.31 on Windows 2008 64bit on Sun, 06 Dec 2009 13:01:29 GMT]]>Hi!

It seems that I have fixed the problem. Attached is logwatch.nsm for Windows x64. Could you please try it?

Best regards,
Victor

logwatch.nsm

]]>https://forum.netxms.org/post/3686https://forum.netxms.org/post/3686Sun, 06 Dec 2009 13:01:29 GMT<![CDATA[Reply to Logwatch Error with NetXMS 0.2.31 on Windows 2008 64bit on Fri, 04 Dec 2009 13:47:31 GMT]]>Hi Victor!

Actually it's a very simple one... only one rule:

<parser>
    <file>*System</file>
    <rules>
        <rule>
            <level>1</level>
            <match>(.*)</match>
            <event params="1">100008</event>
        </rule>
    </rules>
</parser>

]]>https://forum.netxms.org/post/3684https://forum.netxms.org/post/3684Fri, 04 Dec 2009 13:47:31 GMT<![CDATA[Reply to Logwatch Error with NetXMS 0.2.31 on Windows 2008 64bit on Fri, 04 Dec 2009 13:40:16 GMT]]>Hi!

Could you please post your parser configuration file? It may be just one rule which is not working.

Best regards,
Victor

]]>https://forum.netxms.org/post/3683https://forum.netxms.org/post/3683Fri, 04 Dec 2009 13:40:16 GMT<![CDATA[Reply to Logwatch Error with NetXMS 0.2.31 on Windows 2008 64bit on Fri, 04 Dec 2009 08:35:54 GMT]]>After some more analysis and testing I did notice following (seems to be a bug):

As long as I set the windows event log severity to 1 (== ERROR) in the logwathc parser xml-file; eventlog WARNING messages get reportet but not the ERROR'S.

When I change the severity to 2 (== WARNING); WARNING's AND ERRORS get reported.

It seems that the logwatch parser has a problem identifying/filtering the eventlog severity on Windows 2008 servers.

@Victor: Any ideas / chance to fix?

Thanks a lot and kind regards

]]>https://forum.netxms.org/post/3681https://forum.netxms.org/post/3681Fri, 04 Dec 2009 08:35:54 GMT