Information: Forum is in read-only mode
For details and other support options see

EventReporter 5.2 and 7.1 Monilog Formatting

Support, Questions and Discussions on EventReporter

Moderator: alorbach

Google Ads

EventReporter 5.2 and 7.1 Monilog Formatting

Postby blexmark » Thu Dec 14, 2006 5:15 pm

I have a 7.1 client (new), and a 5.2.152 SP2 Client (old)

New Client (using the ... onilog.php post for the monilog format) I get the following output for an event.
2006-12-14,10:35:59,,16,5,EvntSLog: [AUS] Thu Oct 26 20:19:56 2006: <Server1>/Security (540) - "[AUS] Thu Oct 26 16:19:56 2006: <SERVER1>/Security (540) - "Successful Network Logon: User Name: <SERVER1>$ Domain: ACME Logon ID: (0x0,0x765ED) Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name: Logon GUID: {ad302ffc-8519-141d-0968-9e8a298f8464} Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: - Source Port: - ""

Old Client: Has been working for Reports easily with no problems from Monilog reporting.
2006-12-14,00:23:59,,16,4,EvntSLog: [AUF] Thu Dec 14 00:23:32 2006: <Server2>/Security (675) - "Pre-authentication failed: User Name: USERGUY User ID: %{S-1-5-21-799623278-2055409580-1539857752-11572} Service Name: krbtgt/ACME.COM Pre-Authentication Type: 0x2 Failure Code: 0x18 Client Address: 10.the.IP.Here"

Is there anyway to get 7.1 client to log in the exact same fashion as the 5.2 client does so the reporting works?

Any help would be appreciated, I'm banging my head against the wall on this. Only reason I don't upgrade the 5.2 clients is because they "work". So far the 7.1 client is useless until I get reporting on my 2.0.143 Monilog client to work.

Is there a new Monilog client as well? Would that help?

Thanks so much,

Posts: 2
Joined: Thu Nov 02, 2006 6:10 pm

Postby rgerhards » Thu Dec 14, 2006 9:54 pm


please have a look at the "forward syslog" action: ... ptions.htm

If you click on the "insert" link, you can select "MoniLog Format". That should do the trick.

Please let me know if that resoved the issue.

Best regards,
Rainer Gerhards
Site Admin
Posts: 3807
Joined: Thu Feb 13, 2003 11:57 am

Google Ads

Return to EventReporter

Who is online

Users browsing this forum: No registered users and 0 guests