<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; } @font-face { font-family: 'Cambria Math'; } @font-face { font-family: Calibri; } @font-face { font-family: Consolas; } p.MsoNormal, li.MsoNormal, div.MsoNormal { margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; } a:link, span.MsoHyperlink { color: rgb(5, 99, 193); text-decoration: underline; } a:visited, span.MsoHyperlinkFollowed { color: rgb(149, 79, 114); text-decoration: underline; } span.EmailStyle18 { font-family: Calibri, sans-serif; color: blue; } .MsoChpDefault { font-size: 10pt; } @page WordSection1 { margin: 72pt; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Brilliant Zak!<br>
</p>
<p>Thank you very much for this speedy and valuable answer.<br>
</p>
<p><br>
</p>
<p>Dominique - UNIL<br>
</p>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>De :</b> zak.beck@accenture.com <zak.beck@accenture.com><br>
<b>Envoyé :</b> jeudi 25 février 2016 15:34<br>
<b>À :</b> Dominique Frise; xymon@xymon.com<br>
<b>Objet :</b> RE: XymonPSClient and Security eventlog</font>
<div> </div>
</div>
<div>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue">Hi Dominique</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue">This is the event log 'Level' filter.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue">The client uses the Windows event log filtering capabilities built into Windows. You can try these out yourself in Event Viewer by navigating to the Security log
and selecting Filter Current Log….</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue">You will see when doing this that despite selecting the security log, for level the window only offers you Critical, Warning, Verbose, Error or Information and
not Audit Failure / Success. You should find that playing with the options, on the Security log, only "Information" actually returns anything.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue">Looking at the columns for Security log, you should see that the first column changes from Level to Keywords, and that Audit Failure/Success are actually keywords
and not a level.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue">Unfortunately for these reasons it appears there is no way to filter on Audit Failure, unless you can configure an alert with a regex to look specifically for
some text in the message that relates to the failure or the event id.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue"><images dropped></span><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue"></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue"> </span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue">Zak
</span><span style="font-size:9.0pt; font-family:"Arial",sans-serif; color:blue"></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:blue"> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt; font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt; font-family:"Calibri",sans-serif"> Xymon [mailto:xymon-bounces@xymon.com]
<b>On Behalf Of </b>Dominique Frise<br>
<b>Sent:</b> 25 February 2016 11:00<br>
<b>To:</b> xymon@xymon.com<br>
<b>Subject:</b> [Xymon] XymonPSClient and Security eventlog</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<p><span style="font-family:"Calibri",sans-serif; color:black">Hi,</span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black">Question regarding alerting on Security event_log.</span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black">Extract from xymonclient.ps1:</span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt; font-family:"Calibri",sans-serif; color:black"> </span><span style="font-size:9.0pt; font-family:Consolas; color:black"> # default logs - may be overridden by config</span><span style="font-family:"Calibri",sans-serif; color:black"></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt; font-family:Consolas; color:black"> $wantedlogs = "Application", "System", "Security"</span><span style="font-family:"Calibri",sans-serif; color:black"></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt; font-family:Consolas; color:black"> $wantedLevels = @('Critical', 'Warning', 'Error', 'Information', 'Verbose')</span><span style="font-family:"Calibri",sans-serif; color:black"></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt; font-family:Consolas; color:black"> $maxpayloadlength = 1024</span><span style="font-family:"Calibri",sans-serif; color:black"></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt; font-family:Consolas; color:black"> $payload = ''</span><span style="font-family:"Calibri",sans-serif; color:black"></span></p>
</div>
<p><span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black">When problems occurr, "Warning", "Critical or "Error" are reported in Application and System event_log, </span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black">but in the Security event_log "Audit Failure" will be reported.</span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black">We don't see how this condition is handled.</span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black">Did we missed something ?</span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black">Thanks,</span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black">Dominique Frise - UNIL</span></p>
</div>
</div>
</div>
</body>
</html>