NT Event Log

[ttewes]

Hi,

we use HostMonitor 6.10 on MS Server 2003

my problem is the Reply of the NT Event Log check.
The Reply doesn't contain the whole entry of the Event Viewer Description.

We send with HostMonitor a mail within the Reply of a bad Event entry, but in the Message is not the whole and correct Description like in the Event Viewer.

Is there any way to get the whole message?

Regards
ttewes

[KS-Soft]

Use %NTEventText% macro variable

Regards
Alex

[ttewes]

Thangs for your answer, but this doesn't help.

Here are the Message from HostMonitor:

Message from event viewer-check (host changed status)

Test LIN00XX System, Source: IAS
Method check NT Event Log
Status Bad
Date 9/12/2006 9:49:56 AM
Description Message not found. Insertion strings:00-03-47-4A-XX-XX, Domain\00-03-47-4A-XX-XX, 192.168.XXX.XXX, LINXX, %%2147483686, 00-03-47-4A-XX-XX, LINXX, 192.168.XXX.XXX, %%2147483686, %%2147483686, Use Windows authentication for all users, %%2147483688, %%2147483685, %%2147483685, PAP, %%2147483685, 34, %%4130

Folder LIN


and here are the Event Viewer entry

Description:
User 00-03-47-4A-XX-XX was denied access.
Fully-Qualified-User-Name = Domain\00-03-47-4A-XX-XX
NAS-IP-Address = 192.168.XXX.XXX
NAS-Identifier = LINXX
Called-Station-Identifier = <not present>
Calling-Station-Identifier = 00-03-47-4A-XX-XX
Client-Friendly-Name = LINXX
Client-IP-Address = 192.168.XXX.XXX
NAS-Port-Type = <not present>
NAS-Port = <not present>
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server = <undetermined>
Policy-Name = <undetermined>
Authentication-Type = PAP
EAP-Type = <undetermined>
Reason-Code = 34
Reason = Authentication failed because the user account is not enabled. Before the account can be authenticated, a person with administrative rights for either the computer or the domain must enable the user account.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Regards

ttewes

[KS-Soft Europe]

I suppose, the test checks NT Event log on remote host, right? Could you provide certain EventId number. I will try to find what exact .dll you should copy to machine, where HostMonitor is running.

Regards,
Max

[ttewes]

Yes you'r right, the test checks NT Event log on remote host.

The Event ID is 2

Regards,
ttewes

[KS-Soft Europe]

You should open Registry editor on remote machine, and export the key, located under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\<log name>\<event source name>
Import that key onto machine, where HostMonitor is running and copy dll, specified under EventMessageFile value name into appropriate folder.

Regards,
Max

[ttewes]

It looks good,
but the Reason is not correct,
HostMonitor typed: "%%4130"
instead of: "Authentication failed because the user account is not enabled. Before the account can be authenticated, a person with administrative rights for either the computer or the domain must enable the user account."

here the latest mail:

Message from event viewer-check (host changed status)

Test LIN00XX System, Source: IAS
Method check NT Event Log
Status Bad
Date 9/12/2006 11:31:46 AM

Description User 00-03-47-4A-XX-XX was denied access.
Fully-Qualified-User-Name = Domain\00-03-47-4A-XX-XX
NAS-IP-Address = 192.168.XXX.XXX
NAS-Identifier = LINXX
Called-Station-Identifier = %%2147483686
Calling-Station-Identifier = 00-03-47-4A-XX-XX
Client-Friendly-Name = LINXX
Client-IP-Address = 192.168.XXX.XXX
NAS-Port-Type = %%2147483686
NAS-Port = %%2147483686
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = %%2147483688
Authentication-Server = %%2147483685
Policy-Name = %%2147483685
Authentication-Type = PAP
EAP-Type = %%2147483685
Reason-Code = 34
Reason = %%4130


Folder LIN


Regard
ttewes

[KS-Soft]

As I see parameters have been resolved. Somehow "%%4130" is value of "Reason" parameter

Insertion strings:00-03-47-4A-XX-XX, Domain\00-03-47-4A-XX-XX, 192.168.XXX.XXX, LINXX, %%2147483686, 00-03-47-4A-XX-XX, LINXX, 192.168.XXX.XXX, %%2147483686, %%2147483686, Use Windows authentication for all users, %%2147483688, %%2147483685, %%2147483685, PAP, %%2147483685, 34, %%4130

I never have seen such values What Windows is installed on system that generated event?

Regards
Alex

[ttewes]

Windows Server 2003 Enterprise Edition is installed on the system who generated the Event.

Regards
ttewes

[KS-Soft Europe]

Windows Server 2003 Enterprise Edition is installed on the system who generated the Event.

Is it 32-bit or 64-bit Windows Server 2003?

Regards,
Max

[ttewes]

It is a 32-bit Windows Server 2003

Regards
ttewes

[ttewes]

Hi,

have you found some answer for my problem ??

Regards
ttewes

[KS-Soft]

Sorry, we spent hours looking for answer and reading Microsoft manuals but have not find any information about such variables

Regards
Alex

[nate-boit]

You should open Registry editor on remote machine, and export the key, located under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\<log name>\<event source name>
Import that key onto machine, where HostMonitor is running and copy dll, specified under EventMessageFile value name into appropriate folder.

Regards,
Max

Hi. I am having basically the same problem. The main thing I am fighting right now is the problem with "Message not found. Insertion strings: XXXXXX, (0x0,0xXXXXX)," etc. I was looking at your reply here and wondered where exactly you are supposed to import the registry key and put the DLL files.

Thanks

[KS-Soft]

Copy registry key from system that generates events to HostMonitor system.
Then you may create EventLogDlls subdirectory in HostMonitor's folder (e.g. c:\program files\hostmon\EventLogDlls) and copy DLL into this folder.
I hope you are using HostMonitor version 5.82 or higher?

Regards
Alex