topic Re: UF on Server 2012 R2 Not Pulling in WinEventLog Application in Getting Data In

UF on Server 2012 R2 Not Pulling in WinEventLog Application

jodros — Tue, 30 Sep 2014 15:29:29 GMT

This is the first time I have tried running a UF on a server 2012 R2 box. Configuration is the same as my other win boxes. Config being pushed out with deployment server. However no wineventlogs are being sent. UF is 6.1.2. Config from deployment server:

[WinEventLog:Application]
checkpointInterval = 5
current_only = 0
disabled = false
index = app
start_from = oldest

Is this a bug?

Re: UF on Server 2012 R2 Not Pulling in WinEventLog Application

jodros — Tue, 30 Sep 2014 15:33:52 GMT

The "5." by index is not in my config.

Re: UF on Server 2012 R2 Not Pulling in WinEventLog Application

linu1988 — Tue, 30 Sep 2014 15:43:53 GMT

Hello,
I think it is because of your syntax. Could you try the below?

[WinEventLog://Application]
disabled = 0
checkpointInterval = 5
current_only = 0
index = app

Thanks,
L

Re: UF on Server 2012 R2 Not Pulling in WinEventLog Application

jodros — Tue, 30 Sep 2014 15:55:59 GMT

That was my first thought. However after reviewing I believe it is correct. My ds is linux. Verified that the config on the UF is [WinEventLog://Application]. I believe it gets translated. Also, that config on the ds is working on all other winOS boxes.

Re: UF on Server 2012 R2 Not Pulling in WinEventLog Application

linu1988 — Tue, 30 Sep 2014 16:07:21 GMT

Do you see any error? Is all the permissions given for reading the logs? Could you check if system/security logs work?

Re: UF on Server 2012 R2 Not Pulling in WinEventLog Application

jodros — Tue, 30 Sep 2014 17:01:37 GMT

Added Security logs to be monitored. That works, however application logs are not working. I added security log monitoring by using this configuration on the ds:

[WinEventLog:Security]

Which translated to

[WinEventLog://Security]

On the winOS box. I don't know why application logs do not get indexed but security logs do? There are no errors that I can see specific to this issue.

Thanks

Re: UF on Server 2012 R2 Not Pulling in WinEventLog Application

jodros — Tue, 30 Sep 2014 17:27:54 GMT

I also just upgraded the UF from 6.1.2 to 6.1.3. Issues still persists. I might try to install an older version of UF, possibly 5.x.

Re: UF on Server 2012 R2 Not Pulling in WinEventLog Application

linu1988 — Tue, 30 Sep 2014 20:42:30 GMT

they won't support 2012 as per the versions. Newer version should work. Fire a support case. I will try on one of my VM tomorrow to see if it works

Re: UF on Server 2012 R2 Not Pulling in WinEventLog Application

jodros — Tue, 30 Sep 2014 21:46:52 GMT

There was an existing props.conf entry on the indexers to drop wineventlog:application logs by default. Removed and it is working with original syntax. Sorry for the unneeded rabbit trail. Thanks for your time.