<![CDATA[Logparser Windows Event logs]]>Hi,

i have problems when using the log parser.
I try to catch Error 251 from the windows Application Log and forward to NetXMS.

When i just change the EventID to 404 or 406 it is working and i see an entry in the Monitor from Server.
I cant figure out why it is not working with "Error" "EventID 251".
I never see a entry in the Debuglog from client with EventID 251.
I tried with Filter of Source "LSA_MONITOR" or without, doesnt change anything.
Logwatch is enabled in Client Agent.

Thank you!

Sorry i forgot: client and Server are 6.1.1

Screenshot 2026-05-07 105650.png

Screenshot 2026-05-07 102248.png

Screenshot 2026-05-07 102218.png

Screenshot 2026-05-07 102153.png

Screenshot 2026-05-07 110637.png

]]>https://forum.netxms.org/topic/8382/logparser-windows-event-logsRSS for NodeFri, 13 Nov 2026 06:30:08 GMTThu, 07 May 2026 09:13:31 GMT60<![CDATA[Reply to Logparser Windows Event logs on Fri, 12 Jun 2026 12:25:22 GMT]]>Thank you!

]]>https://forum.netxms.org/post/35544https://forum.netxms.org/post/35544Fri, 12 Jun 2026 12:25:22 GMT<![CDATA[Reply to Logparser Windows Event logs on Fri, 12 Jun 2026 10:01:00 GMT]]>Yes, these messages are 251-related. I've created ticket for this issue: https://github.com/netxms/netxms/issues/3322

]]>https://forum.netxms.org/post/35542https://forum.netxms.org/post/35542Fri, 12 Jun 2026 10:01:00 GMT<![CDATA[Reply to Logparser Windows Event logs on Wed, 10 Jun 2026 12:32:22 GMT]]>Hi,

thank you for your answer - maybe i found the problem.

THe error message is like (in German): The message resource exists, but the message was not found in the string/message table.
Maybe this is the 251?

Screenshot 2026-06-10 142814.png

Screenshot 2026-06-10 142937.png

]]>https://forum.netxms.org/post/35529https://forum.netxms.org/post/35529Wed, 10 Jun 2026 12:32:22 GMT<![CDATA[Reply to Logparser Windows Event logs on Tue, 09 Jun 2026 10:05:41 GMT]]>I don't see anything wrong in the configuration (the only thing to check if RAIDCONTROLLER_LSA_CRITICAL had "write to log" checkbox).

You can try right-clicking on the template and performing "Force deployment of agent policies".

Next step is to check that policy file is really present on this machine - they should be in C:\Windows\System32\ config\systemprofile\AppData\Local\nxagentd\logparser_ap (that's home folder of System user).

And next is to enable debug in agent config:
DebugTags = logwatch.*:7
agent log should have detailed information about logparser operations

]]>https://forum.netxms.org/post/35526https://forum.netxms.org/post/35526Tue, 09 Jun 2026 10:05:41 GMT<![CDATA[Reply to Logparser Windows Event logs on Mon, 08 Jun 2026 15:59:38 GMT]]>Hi, thank you for your answer - sorry i was on holidays.

Now i tested it again:

406 is creating a warning - this is working
251 should trigger a Critical warning - i have triggers for: 251 without level, 251 with Level 1 and 2 and 3

But nothing with 251 is working. 406 is triggering fine everytime.

Screenshot 2026-06-08 175446.png

Screenshot 2026-06-08 175332.png

Screenshot 2026-06-08 175519.png

Screenshot 2026-06-08 175530.png

Screenshot 2026-06-08 175619.png

]]>https://forum.netxms.org/post/35519https://forum.netxms.org/post/35519Mon, 08 Jun 2026 15:59:38 GMT<![CDATA[Reply to Logparser Windows Event logs on Thu, 14 May 2026 20:22:17 GMT]]>In the original log parser policy editor screenshot you have Level set to 1, but in XMLs you have values 2 and 3.

]]>https://forum.netxms.org/post/35441https://forum.netxms.org/post/35441Thu, 14 May 2026 20:22:17 GMT<![CDATA[Reply to Logparser Windows Event logs on Wed, 13 May 2026 15:11:38 GMT]]>Hi,

yes it is from the LSA Software from Broadcom which is writing to eventlog.
Here is the XML from EventID 251 and 404/406.

Thank you!

Screenshot 2026-05-13 163056.png

Screenshot 2026-05-13 163206.png

Screenshot 2026-05-13 163231.png

]]>https://forum.netxms.org/post/35432https://forum.netxms.org/post/35432Wed, 13 May 2026 15:11:38 GMT<![CDATA[Reply to Logparser Windows Event logs on Wed, 13 May 2026 11:26:34 GMT]]>Hi,

What are these events from, some RAID software?
Pls double-click on the event in Windows Event viewer and show XML View from Details tab.

]]>https://forum.netxms.org/post/35426https://forum.netxms.org/post/35426Wed, 13 May 2026 11:26:34 GMT