Tagged Questions

The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
1answer
37 views

Determine what is running under a given logon SID

One of my domain controllers is an abnormally large number of windows auditing events. The common thread I have been able to identify is that 90% of these logs share a common logon guid. These ...
3
votes
2answers
25 views

Forwarded Event Logs

I went ahead and successfully configured event fowarding and subscriptions (winrm/wecutil). Now is it possible to have all logs that have already happened to be fowarded to my collector? Or is it only ...
6
votes
5answers
127 views
+50

Windows Event Log Forwarding

I am currently prototyping a setup, in which a Windows Server 2008 is configured as a central logging instance for Windows XP and Windows 7 clients via source initiated event forwarding. All computers ...
0
votes
2answers
49 views

How can I prevent cron from filling up my root partition?

I'm using cron tasks every 3 mins, the result is logged in my cron.log. Also after executing (wget) certain php file, it's name (with 0 bytes filesize) is copied to root, spaming it - see the figure ...
1
vote
1answer
42 views

Windows 2008 Eventlogs best practice and server\Users permission

I have a couple questions about Windows Event Logs and permissions for server 2008 best practice and what Users is in 2008. I am trying to write EVTLogs off to another drive instead of the default ...
1
vote
0answers
30 views

How do I query the contents of an error message in the Windows event log?

So I've got an application event log...let's call it "CustomApplicationLog" I've also got an awesome application...let's call it "MyAwesomeApplication" Assuming this application were to ever throw ...
0
votes
1answer
85 views

Rule to block IP address not working

Looking at my Event Log I see that right now an attempt is being made at brute forcing my 'sa' user for Sql Server on my Windows Server web edition box. I know that firewall rules are not the only ...
2
votes
2answers
29 views

Export entire Windows Log to XML

I want to create a printer statistic and I have a simple but powerfull XML parser. So I want to export all Events from the printer log to the XML format. The print server runs Win2008R2. When I want ...
2
votes
1answer
71 views

Server locking up, /var/log/messages reports “backlog limit exceeded”

We have a CentOS OS that became unresponsive this morning to external network traffic. It is a virtual machine. I was able to reboot the VM. After logging back in, I found the following in the ...
0
votes
1answer
77 views

Disable auditing of logon type 3 events

I have an older 2003 server that hosts an in house application running on IIS with windows authentication. Is there a ready way to disable auditing only for the logon type 3 (network logon)? This ...
4
votes
2answers
104 views

Is it possible to grant Read-Only Access to all Event Logs on Domain Controllers

I would like to grant Read-Access to event logs on all my domain controllers, ideally at a domain level using GPO. I would like members of a group to be able to view the Application Log, the System ...
1
vote
2answers
62 views

Windows Log Viewer (alternative to evntvwr.msc)

I'm wondering if anyone knows of a log viewer that can read .evtx logs and has error hightlighting. Basically I want something thats going to make reading logfiles easier and I can't seem to find one ...
0
votes
1answer
75 views

Event Logs for Remote Share BruteForce

This command is used to access remote shares. net use \10.31.247.2\share /user:admin password Is there any way to detect(EventLogs/other tools) if someone is trying to BruteForce into a remote ...
1
vote
1answer
94 views

Event ID 8021 The browser was unable to retrieve a list of servers from the browser master

We have a LAN where workstations are randomly losing network connectivity for brief moments of time. The workstations can also take a long time to login to the domain. During our troubleshooting we ...
1
vote
1answer
110 views

Server 2008 Audit Failure Event Logs

I am having trouble figuring out what is causing massive audit failures on a server 2008 system. the event id is 4771 Account Name: Administrator Service Name: krbtgt/DOMAIN.NAME Client Address: ::1 ...
1
vote
1answer
46 views

Issue reading EventLog entries for Standard user on Windows 7

I am trying to read the Windows Security Event log by notification. Below is sample line of code, but when I run it on Windows 7 with a standard user I get an Exception: EventLog _eventlog = new ...
0
votes
0answers
58 views

Eventlog service won't start

The eventlog service won't start on a windows 7 sp1. When i try to start the service the machine returns error 0x8007000e (Out of memory). I've checked permissions on logs folder. I've tried to ...
0
votes
0answers
66 views

Finding the most common errors in event logs using Powershell.

I have the event logs for one of our servers locally in .evtx format. I can load the log file into PS using the command: Get-WinEvent -Path D:\Desktop\serverlogs.evtx What I would like to do is on ...
0
votes
1answer
134 views

NtpClient will wait 3473457 minutes (over 6 years!) before it will do a new attempt of DNS resolution, eventid 134

I find the message hilarious and at first I thought it was some joke from an over-active programmer of the MS team, or a hoax. However, the message appears again and again, a couple of times a day: ...
1
vote
1answer
34 views

How do I access the Windows Event Logs on a server instance in Windows Azure?

Can the Event Logs be access on Windows Azure for a deployment with multiple instances? It would be able to view the event logs of each server instance if necessary. The "black box" things just ...
0
votes
1answer
27 views

Is ETW available in Windows Server 2003?

We have an application that is writing to ETW (event tracing for windows) using an ETWTrackingParticipant for trace output. Does anyone know if ETW is supported in Windows Server 2003 or if it only ...
1
vote
1answer
156 views

Schannell: Certificate received from the remote server was issued by an untrusted certificate authoritythe

i'm not sure whether to ask this on dba.stackexchange.com or here. Periodically following error is logged in Windows Server 2008 Administrative events: The certificate received from the remote ...
0
votes
2answers
31 views

Maximum log file size is reset every x time?

The default size of the maximum lof file in my win7 is 4000 KB. I set it to : 900032 KB and it works. But after a period of time - its coming back to 4000KB. How do I prevent that ?
1
vote
1answer
46 views

using New-EventLog to create logs under Applications and Services Logs

I am trying to get the new log to appear as a node under the Applications and Services Logs node in the event viewer, and I just learned here that the Powershell cmdlet New-EventLog will create a new ...
0
votes
2answers
59 views

creating Event Viewer Applications and Services Logs

On my server I want to create custom logs for different applications. How is this done as a server administration exercise?
3
votes
1answer
67 views

Where can I view active directory failed logon attempts?

I do not see any failed logon attempts in my windows sever 2003 security event log (I see only successful ones). However, I have a user that is getting locked out very often and I need to try to ...
0
votes
1answer
26 views

Apache/Server Logs help

I have this on my apache conf <VirtualHost *:80> ServerAdmin info@myweb.com DocumentRoot /var/www/html/web ServerName web.myweb.com ErrorLog logs/index-error_log CustomLog logs/index-access_log ...
0
votes
1answer
71 views

Windows cannot access the file gpt.ini for GPO error

One of my users had a BSOD this morning, so I looked at the event log to see what could be the cause. I didn't find anything obvious related to the BSOD, but I did find something else which causes me ...
1
vote
2answers
161 views

Listing Users using RDP

Windows Server 2008 R2 I'm trying to use PowerShell to get me a list of users who have logged into Remote Desktop Services (formerly known as Terminal Services) during the past day. With little ...
0
votes
1answer
166 views

New set up DHCP Server on Server 2008 R2 won't work, Event-ID 1046

I just set up a 2008 R2 as DC, and DNS. Both worked fine, DNS works fine forward and reverse lookup. Now I wanted to install DHCP. As soon as the installation of the role is finished, I get this ...
0
votes
1answer
227 views

Using the CheckEventLog module of NSClient++, how do I properly filter in two different eventTypes?

I'm having an odd amount of trouble deducing the proper syntax to "filter=in" two eventTypes, warning and error. The line I am using is as follows: CheckEventLog -a truncate=1023 MaxWarn=1 MaxCrit=1 ...
1
vote
4answers
54 views

application required to view event log on web servers locally

I manage several windows web servers with .net web applications installed on them that log any errors to the event viewer. To view the event viewer I remote to each of the web servers and access it ...
3
votes
1answer
147 views

How to clear the DMI System Event Log from linux?

Is it possible to clear the DMI event log (the one that gets partially shown by dmidecode --type 15) from Linux ? I know it can be cleared from the bios but it is a server in a remote location and ...
0
votes
2answers
120 views

Most efficient way to allow a specific user access to event log?

What is the most efficient way to allow a specific user access to event logs? I have come across a method to enforce permissions using local security policy and group policy, but it seems overly ...
0
votes
1answer
45 views

Track changes to Windows Update settings in event log

Is it possible to track down changes to the Windows Update settings in the event logs (Win2008 R2 Std)? I tried filtering the System event log by Source = WindowsUpdateClient but this seems to list ...
1
vote
2answers
87 views

Troubleshooting event id 5146 “Application pool has been disabled” on IIS7

I have a website running on Windows Server 2008 Web Edition, that has suddenly in the last few days started freezing and giving users a "503 Service Unavailable" message. There's a bunch of errors ...
0
votes
3answers
87 views

Getting Some Specific Types of Log

I'm want to get some logs from my server, but not general logs like syslog that gives me a lot of random logs. I want to know how I can get logs of things like logins(with time, IP and username), ...
2
votes
0answers
154 views

What is the Task Scheduler syntax for returning the “ComponentStatus” contents in a Windows Server Backup Event

I have created a Task Scheduler event that emails me on EventID 14 in the Microsoft-Windows-Backup event log (note this is a new , style (Vista and up) log. I exported this and after some grubbing ...
1
vote
3answers
137 views

Monitor Windows event logs for an event and execute a VBS script

I need a free way to monitor the Windows event logs and when a particular event is logged I need to kick off a VBS script. Is there a tool that can do this?
2
votes
2answers
96 views

Catch Windows system log events to a text file

I need to capture w32time events to a text file for a silly compliance requirement. Is there a way to that in Windows?
1
vote
2answers
87 views

How to report who, when and which computer has logged on to a domain controller

I'm completing an audit and need to know the following information below. I have a domain controller with active directory, but let me know if you need any more info. I would like something as simple ...
1
vote
2answers
247 views

Does Exchange 2010 SP1 log OWA login attempts anywhere?

We are having issues where users claim that their Outlook Web access login attempts are intermittently unsuccessful. After a few minutes, it works. I suspect user error but I cannot confirm that ...
3
votes
2answers
191 views

Piping powershell messages to Write-EventLog

I have a powershell script that runs a custom cmdlet. It is run by Task Scheduler and I want to log what it does. This is my current crude version: Add-PsSnapIn PianolaCmdlets Write-EventLog ...
0
votes
1answer
68 views

how to centerlized Client Machine Event Log Auditing to one server?

We have Windows Server 2003 Enterprise DC for 2000 Windows XP SP3 Client Machine. We just want to centralized audit account logon/logoff event, security event log in windows client on one server. we ...
0
votes
0answers
81 views

Windows 2008R2 Event Log not starting Error

I receive an error: Windows could not start the Windows Event Log service. Error 1747: The authentication service is unkown. Any idea what can cause this? 64bit W2008Web the service is indeed not ...
0
votes
1answer
142 views

Exporting logon/logoff events from Windows event log

Environment: Windows Server 2008 R2 with Samba 3.5 domain & OpenLDAP backend. Background: on our previous Terminal Server (Windows Server 2003) we used logon/logoff scripts to log user logins and ...
0
votes
1answer
461 views

Why is the user name “N/A” for most of the event log entries? How to get it filled in?

In my code, if something terribly goes wrong, I write something in the event log (using the ReportEvent function). For those entries, I get a user-id in the event log entry (5th argument of ...
3
votes
2answers
109 views

Novell Netware 6.5 Server Logs

I have inherited a Novell Netware 6.5 server to manage. We had have some users move folders into other folders that they were not supposed to be able to do. Additionally, there have been cases were ...
1
vote
1answer
74 views

IIS Crash/Hang agent Event Viewer logs - are they significant

We have the IIS Crash/Hang agent installed on the production IIS servers. It seems to record quite a lot of start/stop events. Do these imply that something is really happening? if so, what other ...
3
votes
2answers
99 views

Event Logging for RAID fault in 2008 R2

does anyone have a solution for logging an error/critical entry to the event log in 2008 R2 when RAID has an issue? I really want to set up email alerts for when this happens. I'm using the MS builtin ...

1 2 3 4