MonitorWare Knowledge Base

Hi

This may be an underlying database issue

I have a server, which is sending it's event logs to a central database across the internet. When viewing the database using the Console, these events are showing as Success in the NTSeverity view, although in eventlog they are classified as Errors.

Is this a problem with the Console, or the Agent?

I've noticed that when configuring the Event Log service on an Agent, there is the classification Success, as well as Information, Warning, Error, Success Audit and Failure Audit. Where does this Success event actually exist? It isn't the the Eventlog as far as I can see.

Can you shed any light on this?

I've noticed that the NTSeverity field is a number, and have come to the following conclusions:

1 - Error
2 - Warning
4 - Information
8 - Success Audit
16 - Failure Audit

can you confirm?

Hello,

This is not an error in the agent. This is a small bug that is in Console. Thank you for its identification. We will correct it in the actual release.

Best Regards
Wajih-ur-Rehman
Adiscon

Hello,

Regarding your NTSeverity Question, Following are the descriptions corresponding to the codes.

1 Error
2 Success
4 Warning
8 Information
16 Audit_Success
32 Audit_Failure

Best Regards,
Wajih-ur-Rehman
Adiscon

Thanks for the reply

I think you have your codes wrong - I've never seen an NT Severity at 32 - my security logs in the Console are showing information and audit_success, instead of audit_success and audit_failure.

I still can't find "Success" as a valid Windows NT event log type either

I've only ever seen

Error
Warning
Information
Audit Success
Audit Failure

I found this info on Technet, and it doesn't mention the success event log type either:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/win32_ntlogevent.asp

I think this is a problem with the console, and not the agent though.

from my database:
audit_failure=16
audit_success=8
information=4
warning=2
error=1

can you confirm this?

It seems not to be documented in TechEd or MSDN Library.
However, from the WINNT.H Cpp Headerfile:

Code: Select all

//
// The types of events that can be logged.
//
#define EVENTLOG_SUCCESS                0X0000
#define EVENTLOG_ERROR_TYPE             0x0001
#define EVENTLOG_WARNING_TYPE           0x0002
#define EVENTLOG_INFORMATION_TYPE       0x0004
#define EVENTLOG_AUDIT_SUCCESS          0x0008
#define EVENTLOG_AUDIT_FAILURE          0x0010


It may is something obselete or a forgotten Eventlog type

fair enough

is the console showing the wrong text description for the NTSeverity field?

Doh !
It's indeed a display error in the Event row view in MWConsole.

I will check that with our MWConsole development.
Thanks for finding that bug Tosh