"Event log" usually refers to the system/server logs on Microsoft Windows machines.
2
votes
1answer
58 views
What's this odd logon failure I see every day?
I'm having something weird happen on a Windows Server 2008 R2 server.
Every day at exactly 9:00 PM, an Audit Failure is registered in Event Viewer, saying that an account failed to log on for reason ...
0
votes
2answers
84 views
Determine windows server attack? Should I monitor the server and block IPs all the day?
While Viewing the windows server 2008 event log, I always find many security events 4625/logon as follows:
**An account failed to log on.**
Subject:
Security ID: SYSTEM
Account Name: ...
2
votes
2answers
40 views
Event 34 on Windows 2008 R2 write cache and sysvol on system drive
I have Windows Server 2008 R2 running as Active Directory Primary Domain Controller.
Since our domain is not large, I put the SYSVOL and NTDS folders in the default location on the system drive (SSD ...
0
votes
0answers
25 views
Create Windows 2012 Event Viewer custom view
I have folders that I'm tracking with object access auditing. I'd like to create a custom view to see just a specific folder path.
I created a custom filter to just take the Object Access event ...
0
votes
1answer
46 views
AD: delegating computer log access
I would like to setup the following audit scenario:
A large Active Directory domain is scattered among various phisical sites, each contained in its own organizational unit. The members of a ...
0
votes
2answers
53 views
Clean up event log by script
Any way to remove all entries from the Windows event logs (Application, System & Software) apart from the last 24 hours?
Via command line such as batch file.
On Windows 2008 R2 Server & ...
0
votes
2answers
48 views
Windows service restart source
I can see plany of services, including one I'm troubleshooting (custom product service) being restarted on a server occasionally. There is no pattern. One service at random is being restarted every ...
0
votes
1answer
60 views
security_error_ring_buffer_recorded in system health log - what does it mean?
Our company is running a few servers for a couple of websites. The server are running Windows Server 2012 and for databases we have MS SQL Server 2012.
Today I was checking the log files located in:
...
1
vote
1answer
44 views
How to automatically backup Windows event logs?
There doesn't appear to be a way to backup (archive) Windows event logs automatically via the GUI. Is there a way via a script that can be set as a scheduled task to do this? If so, can someone ...
0
votes
1answer
73 views
Suspicious port scanning of spoolsv.exe on Windows server 2003 w/ Print server role
Noticed today on one of the servers, that Event viewer/Security has lots of "Failure audit" messages like this:
The message repeats every second and the port number is increased by one the range ...
0
votes
1answer
63 views
How to fix automatic random restart with Windows Server 2008? [closed]
I'm experiencing random automatic server reboot. I'm trying solve the listed errors on event log. Currently I'm facing the error with:
Event ID: 1
Source : AeLookupSvc
General details : The ...
4
votes
2answers
170 views
How to monitor Windows Server events with Centreon Nagios
I want to monitor events on a Windows Exchange Server (Windows 2008 R2) and have installed NSclient ++ so I can use Centreon Nagios to monitor it. I did a bit of research and came across this question ...
0
votes
1answer
29 views
Group Policy Preference Event id in Window XP [closed]
Whenever Group Policy Preference get auto-update after 90 minutes interval on Window XP. Is there any event id generated or not in Window XP?
Please answer in Yes or No.
If yes than what is Event Id ...
0
votes
0answers
113 views
Windows SharePoint Services 3 Error — Event ID 6398
Every Minute I'm getting an error from Windows SharePoint Services 3. Below is the error text. The access denied part indicates to me that there is a permissions problem.
I have already tried (after ...
0
votes
1answer
45 views
Group Policy Event id [duplicate]
DC - Windows Server 2008 R2
Client OS - Window XP
Which Event id is generated on Window XP, if my Group policy preference is automatically updated after 90 minutes interval.
Sorry, i tried to find ...
0
votes
1answer
46 views
Can eventvwr.msc's log files be exported to text or sql server in Windows?
Can the events from the "Event Viewer" (eventvwr.msc) in Windows (7/2003 Server/2008 Server R2) be exported to sql server or to text files?
Every search I do on Google for this returns how to export ...
0
votes
1answer
223 views
Event Log > Filter Current Log > XML > where EventData contains text
I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below:
...
1
vote
0answers
110 views
What do these IPMI System Event Logs mean?
I'm currently trying to troubleshoot what seem to be hardware issues with a x3650 m3 machine. Using IPMItools, I'm reading recurring assertion events from sensor type: 0F, sensor no: B5 that repeat ...
0
votes
0answers
96 views
Event id 5723 netlogon when joining a new pc to domain
Is there any reason I would get the event id 5723 when joining a new windows 7 professional notebook to an existing windows server 2003 domain?
The notebook eventually did join successfully but that ...
0
votes
0answers
56 views
Solaris 10 Auditing of HTTP / HTTPS Request Logs
I need to gather data about HTTP/S requests made to the server. However, the application server (IBM WebSphere 7) running on it doesn't have any auditing turned on, and the applications on it don't ...
2
votes
1answer
74 views
Discrepancy between Event Log taken from Powershell and with Event Log Viewer
Domain Controller OS - Window Server 2008 R2
Please see the First PrintScreen attached (Powershell.png). with the help of Powershell command I am trying to check the event Log of my DC. Please note ...
0
votes
2answers
234 views
Event ID 2013 (Disk Is At Or Near Capacity) not getting logged
I'm trying to set up alerts for low disk space conditions on a server (Windows Server 2008 R2 Enterprise, SP1). To do this I want to trigger an email via Task Scheduler whenever Event ID 2013 is ...
0
votes
0answers
18 views
Unexpected two consecutive event id 6009 in logFile windows server 2003
i'm analizing a log file from windows server 2003 i have found two consecutive logs with eventID 6009. Between this logs and after the second, there aren't other any logs like 6006, 6008 or similar ...
0
votes
1answer
52 views
BINLSVC warning in event log - netclass.inf parsing Manufacture
So I am trying to get Remote Installation Service Running on a Windows Server 2003 R2 Standard Edition with Service Pack 2 installed. I am trying to integrate network drivers into the image and I keep ...
1
vote
0answers
18 views
Clear specific entries in Security Log, Event Log in Windows 8 [duplicate]
Possible Duplicate:
How can I remove specific events from the event log in Windows Server 2008?
Is it possible to remove specific entries in Event Log of Windows 8? Which tools could I use? ...
0
votes
1answer
61 views
SBS 2003 no network connection and acting strangely a bunch of Event ID 13568
I've got an SBS 2003 Standard server and it was running fine until earlier today when it was rebooted, after the reboot it has no network connection, I can't seem to right click on a lot of stuff and ...
2
votes
1answer
102 views
New event log nowhere to be found after creating in PowerShell
Through PowerShell, I am attempting to create a new event log and write a test entry to it, but it is not showing up the Event Viewer. This is the command I'm using to create a new event log:
...
0
votes
2answers
51 views
Lots of Failure Alerts on my DC
I am receiving lots of Failure Audit logs on my DC, can you guide me - how should i identify the culprit.
Please see the below print-screen for more detail. The logon type is 3, that means it is a ...
1
vote
2answers
272 views
Is it possible to export Windows event logs from multiple servers to a non-windows host, without running event manager on each of the Windows servers?
I want to export event logs from Windows to a non-Windows host. I was considering using Logstash, but that would seem to require that I install and run Logstash on each server. Is it possible to do ...
0
votes
2answers
247 views
how to open a saved eventlog file with display information
i saved an eventlog with display information on a computer. now i want to open this file on another computer with full event description. in my understanding this information should be saved in the ...
0
votes
1answer
147 views
Cisco Nexus syslog messages format?
I'm trying to normalize Syslog messages generated by a Cisco Nexus box.
Problem: Messages have the following format:
<189>: yyyy mm dd hh:mm:ss UTC: text
This is not a standard Syslog message, no ...
0
votes
0answers
51 views
The DNS server encountered an invalid DNS update message from [IP-address]
I have a bunch of messages like this in DNS Server log.
I've already changed Name checking setting to All Names for this server, but messages still appear, but less frequently.
It's an ...
0
votes
2answers
199 views
Moving Windows event logs without corrupting them
I need to retrieve the event logs from an XP embedded machine which doesn't have the Event Viewer, to an XP pro machine with the Event Viewer and then view the logs.
Whenever I move an event log it ...
1
vote
1answer
132 views
Remote Desktop IP missing in Event Log
I was checking my remote desktop event logs and an entry is confusing for me.
The event was a normal log on event with a username, but at details have a dash (-) for the source IP instead of a source ...
0
votes
0answers
468 views
What would cause so many EventID 4656 PlugPlayManager Security Audit Failures at one time?
I found 141 PlugPlayManager Security Audit Failures logged within the same minute on one of our Server 2008 R2 servers (running only SQL 2008 R2). While Googling all I could find was other people, ...
4
votes
1answer
755 views
What are the differences between Windows EVT and EVTX log files?
Windows is moving to the *.EVTX format for their logging files, but we still have clients that have versions that write to the older *.EVT format. What are the differences in how those files are ...
2
votes
1answer
2k views
System Account Logon Failures every 30 seconds
We have two Windows 2008 R2 SP1 servers running in a SQL failover cluster. On one of them we are getting the following events in the security log every 30 seconds. The parts that are blank are ...
0
votes
1answer
877 views
Dell Open Manage message in Windows Event Log, should I be worried?
I have a Dell T110 server with a SAS 6i/R controller and two hard disks in RAID 1. Ocasionally a warning appears in the Windows Event Log with the following message:
SAS port report: SAS wide port ...
1
vote
1answer
253 views
Eventlog entry for allowed connection in Windows Firewall
I was seeing a lot of entries in the eventlog:
The Windows Filtering Platform has permitted a connection.
Application Information:
Process ID: 4
Application Name: ...
3
votes
2answers
61 views
What log messages do I need to look for that indicate the start of a log-off in Windows Event Viewer?
Is there an Info message in Windows Event viewer that indicates the start of a log off? I'm trying to spot errors and warnings as a user logs off.
0
votes
2answers
545 views
Permissions needed to read event log messages remotely?
When running under a limited account, local event log messages are displaying fine, for remote computer I am getting this error:
The description for Event ID ( xxxxx ) in Source ( yyyyy ) cannot be ...
1
vote
0answers
120 views
Windows Centralized Log Subscription
Does anyone know how to setup the windows Centralized log? because i've followed a bunch of tutorials and i can see the server in Runtime Status, but only the server hosting the centralized log sends ...
1
vote
2answers
385 views
Forward Windows Events Logs to Rsyslog
I would like to forward Windows Events Logs from all my desktop clients to a Linux box with rsyslog on.
Rsyslog provide a Windows agent to do just that but its 40 euros per license and when you have ...
5
votes
2answers
737 views
Is there any way to undo after clearing a log on Windows 2008 server?
I accidentally cleared a event log. Is there any way I can get it back?
2
votes
1answer
37 views
How can I remove the sorting in the Event Log?
I made the mistake of clicking the Date and Time column in the event log. Now, whenever I open that log, it takes like 10 seconds for it to sort all entries.
This is highly annoying, especially since ...
2
votes
1answer
200 views
Deleted a CA improperly and receiving a 10009 Event ID error
The basic run down is I didn't know what I was doing and I deleted a CA I stood up but I couldn't get to work properly. I know dumb. But that being said not much I can do about it now. I went through ...
3
votes
1answer
128 views
Audit when users log on and off servers
We have contractors periodically remoting into our production servers and goodness know what changes that they could potentially make. So What can I use to log when users log on or off a server(s)?
...
1
vote
0answers
75 views
Client Address is not showing correct in Event Log
I had enable the Advance Audit Policy Configuration on my Domain Controller.
Server OS - Window Server 2008 R2 Standard.
Client OS - Window XP
Whenever the Domain User enter wrong password for ...
0
votes
1answer
113 views
auditpol starting infinite loop in command prompt
On our 3 Windows 2008 domain controllers, I have started to see a LOT of Audit Failure, Event 5159 errors.
I did some troubleshooting around the internet and found out that I should stop auditing a ...
2
votes
1answer
194 views
Lots of FAILURE AUDIT: an account failed to log on entires in Security Log
I have received lots of failure audits on my server. From the log, I have identified the particular machine that is the culprit. How can I identify which process is sending the login request?
Do you ...
