https://community.splunk.com/t5/Getting-Data-In/Why-are-Windows-Event-Logs-from-a-Windows-Server-2003-missing-a/m-p/186812#M37389 <P>Some events (628 and 644) of a Windows 2003 are coming in with an empty Message field.</P> <P>ex:</P> <PRE><CODE>LogName=Security SourceName=Security EventCode=628 EventType=8 Type=Success Audit ComputerName=server1 User=userx Sid=S-1-5-21-1805228463-3643871152-3900399489-27398 SidType=1 Category=7 CategoryString=Account Management RecordNumber=665178237 Message= </CODE></PRE> <HR /> <P>However, other events such as 680, 540, 538, 672, 836, 837 are logging correctly.</P> <P>ex:</P> <PRE><CODE>LogName=Security SourceName=Security EventCode=680 EventType=16 Type=Failure Audit ComputerName=server1 User=SYSTEM Sid=S-1-5-18 SidType=5 Category=9 CategoryString=Account Logon RecordNumber=6651ff787 Message=Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: hosta$ Source Workstation: \\hosta Error Code: 0xC0000199 </CODE></PRE> <HR /> <P>It is normal? </P> Wed, 26 Aug 2015 20:17:55 GMT sergeimartao 2015-08-26T20:17:55Z https://community.splunk.com/t5/Getting-Data-In/Why-are-Windows-Event-Logs-from-a-Windows-Server-2003-missing-a/m-p/186812#M37389 <P>Some events (628 and 644) of a Windows 2003 are coming in with an empty Message field.</P> <P>ex:</P> <PRE><CODE>LogName=Security SourceName=Security EventCode=628 EventType=8 Type=Success Audit ComputerName=server1 User=userx Sid=S-1-5-21-1805228463-3643871152-3900399489-27398 SidType=1 Category=7 CategoryString=Account Management RecordNumber=665178237 Message= </CODE></PRE> <HR /> <P>However, other events such as 680, 540, 538, 672, 836, 837 are logging correctly.</P> <P>ex:</P> <PRE><CODE>LogName=Security SourceName=Security EventCode=680 EventType=16 Type=Failure Audit ComputerName=server1 User=SYSTEM Sid=S-1-5-18 SidType=5 Category=9 CategoryString=Account Logon RecordNumber=6651ff787 Message=Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: hosta$ Source Workstation: \\hosta Error Code: 0xC0000199 </CODE></PRE> <HR /> <P>It is normal? </P> Wed, 26 Aug 2015 20:17:55 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-Windows-Event-Logs-from-a-Windows-Server-2003-missing-a/m-p/186812#M37389 sergeimartao 2015-08-26T20:17:55Z https://community.splunk.com/t5/Getting-Data-In/Why-are-Windows-Event-Logs-from-a-Windows-Server-2003-missing-a/m-p/186813#M37390 <P>I managed to solve the problem.</P> <P>I had to change the UF version 2.2 of splunk to 1.9 in Windows 2003.<BR /> After that the log text came complete.</P> Thu, 03 Sep 2015 17:40:09 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-Windows-Event-Logs-from-a-Windows-Server-2003-missing-a/m-p/186813#M37390 sergeimartao 2015-09-03T17:40:09Z