The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
1answer
17 views

What is “Ticket Options” Referring to in Domain Controller Event Logs?

I'm trying to figure out what Ticket Options is referring too within this event log off my domain controller. It is in response to a kerberos authentication request. AgentDevice=WindowsLog ...
3
votes
1answer
33 views

vSphere/ESX How to log migration event to guest Windows OS

On a vSphere/ESX environment, how to write (automated) migration events to the eventlog into the hosted Windows VM that has been migrated? So that the hosted OS is aware of the migration event, and ...
0
votes
1answer
140 views

What time zone are the description timestamps in Windows Event log (UTC?)

Log Name: System Source: LsaSrv Date: <date> <time> Event ID: 45058 Task Category: Logon Cache Level: Information Keywords: Classic User: N/A Computer: computername.contoso.com ...
0
votes
0answers
8 views

Can't view event subscriptions via remote console

When I connect to my event collector via eventvwr.msc I don't see the subscriptions node. The highlighted node is not there when viewing remotely: I can accept that I can't do this via remote ...
1
vote
0answers
208 views

Event Log - MsiInstaller events' description cannot be found since last week

Since last week, machines in my network are not properly recording events from MsiInstaller. For instance: The description for Event ID ( 11724 ) in Source ( MsiInstaller ) cannot be found. The ...
4
votes
1answer
4k views

Event logger won't start: error 2 The system cannot find the file specified, Windows server 2008R2

NOTE: this is a "spawn" of a previous post which dealt with 2 different issues and became too lengthy, so I decided to clean the original question and post this issue in a separate question When I ...
3
votes
1answer
2k views

Windows 2008 R2 services not working

EDIT I spawned the Windows events logging service won't start issue to a separate question here I have a strange problem: SQLAGENT won't start Windows events logging service won't start Today I ...
1
vote
2answers
516 views

Write to Windows Event Log when an IIS site is started or stopped

Can I configure IIS 7.5 to write to the Windows Event Log whenever one of the sites on the web server is started or stopped? For example when someone starts/stops a site via the IIS Manager user ...
0
votes
0answers
94 views

What's Up Gold Event Log Messages

Background We use What's Up Gold (WUG) to monitor our servers. A requirement has recently come in for alerts to be sent when specific events appear in servers' event logs. We've met this requirement ...
1
vote
3answers
531 views

Window's native event forwarding directly to a syslog\sql server

Right now I have events being forwarded to a collector on which I then run a script to pull them out of the collector's event logs as xml and then insert them in a DB. Is there any utility that knows ...
5
votes
2answers
5k views

Filtering Security Logs by User and Logon Type

I have been asked to find out when a user has logged on to the system in the last week. Now the audit logs in Windows should contain all the info I need. I think if I search for Event ID 4624 (Logon ...
1
vote
0answers
57 views

Computer management, Access denied only on win XP VMs

This may take a few lines to setup, so bear with me. My company runs vmware, mix of win xp and win 7 VMs. My tech group have admin rights throughout the domain. We're having some scanning issues ...
1
vote
3answers
3k views

Query specific logs from event log using nxlog

Below is my nxlog configuration define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log ...
2
votes
1answer
452 views

I need an XPath query to view all events in the Windows event log (custom view)

In Windows powershell you can type get-winevents without any parameters and it will dump all events. I would like access to all events in the event viewer using a custom view. I can of course just ...
0
votes
1answer
59 views

Odds of a given Windows EventID to be unique for a Source?

I am using the basic NRPE plugins for Nagios to passively monitor Windows Eventlog. The plugin allows for an EventID exception list as a command argument. So, for instance, I can block any event that ...
0
votes
1answer
116 views

OpenVPN - Windows redirect log to windows event log

Running OpenVPN as a service, How do I redirect the log (which defaults saves to \program files\openvpn\log or if --log is specified) to windows event logger. I don't want to store logs in more ...
0
votes
1answer
199 views

Can I collect Syslog events in the Windows Event Collector? [duplicate]

I have a couple of *nix based systems that I'd like to start collecting logging information for. Is there a way to forward Syslog events to a Widnows server running the Windows Event Collector ...
1
vote
1answer
202 views

Discrepancy between Event Log taken from Powershell and with Event Log Viewer

Domain Controller OS - Window Server 2008 R2 Please see the First PrintScreen attached (Powershell.png). with the help of Powershell command I am trying to check the event Log of my DC. Please note ...
0
votes
1answer
325 views

Turning windows event id 4616 off

Every time a windows box synchronizes its time to an NTP server, the NTP client logs two entries with event Id of 4616 into windows' event log and since I've setup my server to sync the time every 60 ...
3
votes
1answer
549 views

Save and clear eventlogs

I am looking for ideas on how to save and clear event logs on multiple servers through use of a script. There used to be a tool for Windows Server 2000 called "Eventlog.pl" that could save and clear ...
12
votes
2answers
34k views

Who restarted my Windows server? [duplicate]

Is it possible on Windows Server 2000/2003/2008 machines to see which user rebooted the server? I have found the shutdown event in the System event log, but it does not show which user initiated the ...
1
vote
2answers
519 views

Issue reading EventLog entries for Standard user on Windows 7

I am trying to read the Windows Security Event log by notification. Below is sample line of code, but when I run it on Windows 7 with a standard user I get an Exception: EventLog _eventlog = new ...
2
votes
0answers
388 views

Write a MIB file that defines entire

I am attempting to configure event log monitoring to snmp trap "service" on Windows Server. See: How do I passively monitor the Windows Event Log? & ...
1
vote
3answers
1k views

How can I generate Windows Logs for testing purposes?

I'm trying to test some Splunk-y things with my Windows logs. But I want to be sure of the logs that are coming in so I can be sure I'm keeping and discarding logs properly. What I'm really looking ...
2
votes
3answers
11k views

troubling anonymous Logon events in Windows Security event log

I have a dedicated server hosted on Rackspace Cloud, and this morning as I was casually checking the Security event log, I saw a series of successful Logon events that are troubling. It appears ...
0
votes
1answer
2k views

Parse wevtutil XML into a database?

I'm by no means an XML expert. Ergo, I'm having trouble importing Windows event XML from wevtutil into an SQL database. Prior to Server 2008, we exported event log data to the database directly ...
11
votes
1answer
57k views

Where/how does Windows store the data in the event logs?

We run some financial systems that log error messages to the system logs. I need to find out if we can clean these error messages from a PCI DSS point of view. I am specificaly interested in the ...
1
vote
2answers
1k views

How to set read/write (but not delete) permissions on the Windows Application Event log?

My ASP.NET application needs to be able to write to the windows event log and read from the windows event log using WMI. I don't want the application account- currently NETWORK SERVICE, to be able to ...