Information: Forum is in read-only mode
For details and other support options see https://www.adiscon.com/news/support-forum-set-to-read-only-mode/

NT Event Log Errors showing as Success in console

Support, Questions and Discussions on MonitorWare Console

Moderator: alorbach

Google Ads


NT Event Log Errors showing as Success in console

Postby tosh » Wed Apr 30, 2003 5:34 pm

Hi

This may be an underlying database issue

I have a server, which is sending it's event logs to a central database across the internet. When viewing the database using the Console, these events are showing as Success in the NTSeverity view, although in eventlog they are classified as Errors.

Is this a problem with the Console, or the Agent?

I've noticed that when configuring the Event Log service on an Agent, there is the classification Success, as well as Information, Warning, Error, Success Audit and Failure Audit. Where does this Success event actually exist? It isn't the the Eventlog as far as I can see.

Can you shed any light on this?
tosh
Frequent Poster
 
Posts: 83
Joined: Fri Feb 28, 2003 3:14 pm
Location: London, UK

Postby tosh » Wed Apr 30, 2003 6:10 pm

I've noticed that the NTSeverity field is a number, and have come to the following conclusions:

1 - Error
2 - Warning
4 - Information
8 - Success Audit
16 - Failure Audit

can you confirm?
tosh
Frequent Poster
 
Posts: 83
Joined: Fri Feb 28, 2003 3:14 pm
Location: London, UK

Postby Guest » Fri May 02, 2003 7:22 am

Hello,

This is not an error in the agent. This is a small bug that is in Console. Thank you for its identification. We will correct it in the actual release.

Best Regards
Wajih-ur-Rehman
Adiscon
Guest
 

Postby Guest » Fri May 02, 2003 7:59 am

Hello,

Regarding your NTSeverity Question, Following are the descriptions corresponding to the codes.

1 Error
2 Success
4 Warning
8 Information
16 Audit_Success
32 Audit_Failure

Best Regards,
Wajih-ur-Rehman
Adiscon
Guest
 

Postby tosh » Fri May 02, 2003 2:30 pm

Thanks for the reply

I think you have your codes wrong - I've never seen an NT Severity at 32 - my security logs in the Console are showing information and audit_success, instead of audit_success and audit_failure.

I still can't find "Success" as a valid Windows NT event log type either

I've only ever seen

Error
Warning
Information
Audit Success
Audit Failure

I found this info on Technet, and it doesn't mention the success event log type either:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/win32_ntlogevent.asp

I think this is a problem with the console, and not the agent though.

from my database:
audit_failure=16
audit_success=8
information=4
warning=2
error=1

can you confirm this?
tosh
Frequent Poster
 
Posts: 83
Joined: Fri Feb 28, 2003 3:14 pm
Location: London, UK

Postby alorbach » Fri May 02, 2003 2:43 pm

It seems not to be documented in TechEd or MSDN Library.
However, from the WINNT.H Cpp Headerfile:

Code: Select all
//
// The types of events that can be logged.
//
#define EVENTLOG_SUCCESS                0X0000
#define EVENTLOG_ERROR_TYPE             0x0001
#define EVENTLOG_WARNING_TYPE           0x0002
#define EVENTLOG_INFORMATION_TYPE       0x0004
#define EVENTLOG_AUDIT_SUCCESS          0x0008
#define EVENTLOG_AUDIT_FAILURE          0x0010


It may is something obselete or a forgotten Eventlog type ;)
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Postby tosh » Fri May 02, 2003 2:47 pm

fair enough

is the console showing the wrong text description for the NTSeverity field?
tosh
Frequent Poster
 
Posts: 83
Joined: Fri Feb 28, 2003 3:14 pm
Location: London, UK

Postby alorbach » Fri May 02, 2003 2:59 pm

Doh :shock: !
It's indeed a display error in the Event row view in MWConsole.

I will check that with our MWConsole development.
Thanks for finding that bug Tosh ;)
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Google Ads



Return to MonitorWare Console

Who is online

Users browsing this forum: No registered users and 0 guests

cron