WatchDirectory Forum
http://www.watchdirectory.net/cgi-bin/yabb25/YaBB.pl
watchDirectory forums >> How to... >> Event Error
http://www.watchdirectory.net/cgi-bin/yabb25/YaBB.pl?num=1128665743

Message started by JimKnopf on Oct 7th, 2005 at 8:15am

Title: Event Error
Post by JimKnopf on Oct 7th, 2005 at 8:15am
Hello,

i have an event error after starting a task. does someone now what happend?

exception while processing event log record, event was ignored

Thanks
Frank

Title: Re: Event Error
Post by Gert on Oct 7th, 2005 at 8:35am
Hi Frank,

I guess you are using the "who did it" plugin (http://www.watchdirectory.net/wdhelp/plugins/wdopAuditInfo.html? This can happen if the mapping file you are using is not "compatible" for the operating system it is reading the event-log from (or you are using an older version that didn't support mapping files, please download the latest version).
See http://www.watchdirectory.net/wdhelp/plugins/wdopAuditInfoMap.html how to request a new mapping file.

Gert

Title: Re: Event Error
Post by JimKnopf on Oct 7th, 2005 at 8:47am
Hi Gert,

i selectet the "automatically alerts you when someone delete a file" task.
i do not scan an mapping share. i have a windows 2003 Test Server. and i would like to scan local files. can i send you my eventlog?
I have an other Test server, installed the same OS. That have not these problems.
Thanks
Frank

Title: Re: Event Error
Post by Gert on Oct 7th, 2005 at 9:09am
Yes, please follow the instructions here http://www.watchdirectory.net/wdhelp/plugins/wdopAuditInfoMap.html.

It will probably take a day or two before I get to it.

Gert

Title: Re: Event Error
Post by JimKnopf on Oct 7th, 2005 at 2:01pm
Hi Gert,

now, i have the same error on the other machine. The error occurs when the service starts or stop.
Frank

Title: Re: Event Error
Post by Gert on Oct 7th, 2005 at 3:03pm
Frank,

The eventlog you sent to me is not the log I need, let me try to explain.

You are using the plugin that can send an email with the userid that deleted a file (http://www.watchdirectory.net/wdhelp/plugins/wdopAuditInfo.html).
This plugin needs to scan the Windows Event Log (the Security log) to find that userid. The problem is that the "layout" of the event log is different for WinNT, XP, 2000 and 2003.

WatchDirectory has knowledge of this layout because it uses "mapping files" that describe the security event log for different operating systems.

When you install the latest version of WD, there are 2 mapping files, one for Windows XP, and one for Windows 2000.

If you use the wrong mapping file, you will get those errors in your application log. For XP, and probably Windows 2003 too, you should use the "Windows XP" mapping file.

For Windows NT and 2000, use the "Windows 2000" mapping file.

Gert

Title: Re: Event Error
Post by JimKnopf on Oct 7th, 2005 at 3:13pm
Hi Gerd,

i use the winxp one. the logging is ok. every deletet file will create a special log file.
or is it possible to use an other plugin to resolved information about the user that deletes files/folders?
Should i send you the configuration file of the task?
Thanks
Frank

Title: Re: Event Error
Post by Gert on Oct 7th, 2005 at 3:22pm
Maybe I am wrong about the mapping file you should use...
Can you try the Win2000 one instead?

If that doesn't work, can you sent me the "security event log" (not the application event log)?

Gert

Title: Re: Event Error
Post by JimKnopf on Oct 7th, 2005 at 3:36pm
Hi Gert,

it doesn´t work. I will send you the log.
Frank

Title: Re: Event Error
Post by Gert on Oct 9th, 2005 at 11:06am
Can you perhaps try the latest version 4.0.36. I've made a few improvements to the "audit" plugin, and think it will not cause those exceptions anymore.

Gert

WatchDirectory Forum » Powered by YaBB 2.5.2!
YaBB Forum Software © 2000-2017. All Rights Reserved.