NetXMS Forum

Hi Victor!

I did the following:

C:\NetXMS\bin>nxagentd.exe -R
Win32 Agent service deleted successfully
Event source "NetXMS Win32 Agent" uninstalled successfully

C:\NetXMS\bin>nxagentd.exe -I -c "C:\NetXMS\etc\nxagentd.conf"
Service "NetXMSAgentdW32" created successfully
Event source "NetXMS Win32 Agent" installed successfully

Unfortunately it is still not working. I did try it as well with the 0.2.31 Version and the "fixed" logwatch.nsm go created once, but strangly it is as well not working.

Hi Victor,

any news/ideas on this issue?

Kind Regards

Hi Victor

It's a english version. I checked with the other systems where logwatch is working, and the only thing which was different, that for non-unicode regional settings the one which gives us problems the location was set to german-switzerland. I changed this to english, but no success.

After Upgrading to the latest available release (1.1.0-rc11) Logwatch stoped working on some systems.
When I trace I get the following errors in the debug log:

LogWatch: publisher name is NetXMS Win32 Agent
LogWatch: Call to EvtFormatMessage failed: The specified resource language ID cannot be found in the image file.

Any ideas why?

Kind Regards

Nikos

Hi Victor!

many thanks for the QUICK answer!

Kind regards

Hi,

By default, alerts sent by email come with "NetXMS Server" as display name.
In the server configuration I am able to modify the from email address, but not the display name.
Since we have more that one NetXMS server running, we would like to modify this value, so we see immediately from which NetXMS node it has been sent.

Any way to configure this?

Thanks for your feedback!

Hi there!

My NetXMS Server Application is crashing quite often with the error below. This happens since Release 0.2.21. After the upgrade to the most recent version, unfortunately nothing changed on that. Any ideas?
A workaround i changed the recovery behaviour of the netxms server service. But this ist not a real solution for the problem.

Any comments very appreciated!
Thanks and regards

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 09.12.2009
Time: 11:09:35
User: N/A
Computer: ********
Description:
Faulting application netxmsd.exe, version 0.0.0.0, faulting module nxcore.dll, version 0.0.0.0, fault address 0x0004a30a.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74  Applicat
0008: 69 6f 6e 20 46 61 69 6c  ion Fail
0010: 75 72 65 20 20 6e 65 74  ure  net
0018: 78 6d 73 64 2e 65 78 65  xmsd.exe
0020: 20 30 2e 30 2e 30 2e 30    0.0.0.0
0028: 20 69 6e 20 6e 78 63 6f    in nxco
0030: 72 65 2e 64 6c 6c 20 30  re.dll 0
0038: 2e 30 2e 30 2e 30 20 61  .0.0.0 a
0040: 74 20 6f 66 66 73 65 74  t offset
0048: 20 30 30 30 34 61 33 30    0004a30
0050: 61                        a

Dear Victor

Works perfect now!
What should I say..... your support and response time was BRILLIANT once AGAIN!
Many, many thanks for that!
Have a great week and kind regards

Hi Victor!

Actually it's a very simple one... only one rule:

<parser>
    <file>*System</file>
    <rules>
        <rule>
            <level>1</level>
            <match>(.*)</match>
            <event params="1">100008</event>
        </rule>
    </rules>
</parser>

After some more analysis and testing I did notice following (seems to be a bug):

As long as I set the windows event log severity to 1 (== ERROR) in the logwathc parser xml-file; eventlog WARNING messages get reportet but not the ERROR'S.

When I change the severity to 2 (== WARNING); WARNING's AND ERRORS get reported.

It seems that the logwatch parser has a problem identifying/filtering the eventlog severity on Windows 2008 servers.

@Victor: Any ideas / chance to fix?

Thanks a lot and kind regards

Hi,

I have upgraded our systems with the NetXMS Agent version 0.2.31. So far no issues, BUT:
Monitoring Windws Event Log's on Windows 2008 64bit systems stoped working.
Note: in earlier releases we where only able to install the 32bit version on 64bit systems. (64bit agent gave us errors during install)
With version 0.2.31 this seems to be fixed, but the errors are indicating that ther may be something wrong with the 64bit agent distribution.
Wondering if anybody else had/has this issue?

I added the trace="1" to the parser section and started the agend in debug mode (with the -D flag) and that's the result in the debug log:

[03-Dec-2009 15:19:19] Debug: LogWatch: registered parser for file *System, trace level set to 1
[03-Dec-2009 15:19:19] Debug: LogWatch: Start watching event log "System" (using EvtSubscribe)
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent
[03-Dec-2009 15:19:19] Debug: LogWatch: publisher name is NetXMS Win32 Agent

Hi Victor

Thanks for your quick response!
It is regarding Windows 2003 Server Systems. We just get no events.
I have tried it with various logs which are added to the system by 3rd party applications, unfortunately with no success.
Let me know if you would need more info's.

Kind Regards

Nikos

Has anybody used the LogWatch function succesfully with other Windows Event Logs than Applicaton/System/Security?
There are many applications with add their own application specific eventlog to the windows event log facility.
However, I tried to monitor these in the same way as it is working for the *System, *Application etc, but unfortunately with no success.
Any help/comments on this are very appreciated!

Below some useful informations:

@victor said:

You don't need DCI for log monitoring - all LogWach.Parser.* parameters are for collecting parser statistic (and not working as expected in current release). When log parser finds record that match to certain rule, it just sends event specified in <event> tag of the rule to server. Overall configuration steps for configuring log monitoring is following:

1. Create events (in console via Control Panel -> Events);
2. In parser's XML config, use event codes of your created events in <event> tags. Parser will send them when matching record will appear in log.
3. Configure rules for processing these events in event processing policy - you can create alarms, send e-mails, and so on, as for any other event.

Best regards,
Victor

P.S. Can we move our conversation to public forum? It may be useful for others too.

GREAT stuff! Many thanks, it works now!

I have toubles compiling an NetApp MIB:

NETWORK-APPLIANCE-MIB.mib.txt: ERROR 003: Parser error - syntax error, unexpected OBJECT_SYM, expecting OBJECT_TYPE_SYM in line 18622

Attached the MIB that causes the error.
If somebody can help --> THANKS in advance!

Hi There

It would be great, if the information regarding LogWatch and Windows Event Log monitoring would be available in english too!

Any chance?

Thanks a lot!