<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:blue;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-GB link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue;mso-fareast-language:EN-US'>Hi Dominique<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue;mso-fareast-language:EN-US'>This is the event log 'Level' filter.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue;mso-fareast-language:EN-US'>The client uses the Windows event log filtering capabilities built into Windows. You can try these out yourself in Event Viewer by navigating to the Security log and selecting Filter Current Log….<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue;mso-fareast-language:EN-US'>You will see when doing this that despite selecting the security log, for level the window only offers you Critical, Warning, Verbose, Error or Information and not Audit Failure / Success. You should find that playing with the options, on the Security log, only "Information" actually returns anything.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue;mso-fareast-language:EN-US'>Looking at the columns for Security log, you should see that the first column changes from Level to Keywords, and that Audit Failure/Success are actually keywords and not a level.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue;mso-fareast-language:EN-US'>Unfortunately for these reasons it appears there is no way to filter on Audit Failure, unless you can configure an alert with a regex to look specifically for some text in the message that relates to the failure or the event id.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue'><img width=983 height=763 id="Picture_x0020_1" src="cid:image001.png@01D16FD9.ADDE2BE0"></span><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue;mso-fareast-language:EN-US'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue'>Zak </span><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:blue'><o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:blue;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri",sans-serif'> Xymon [mailto:xymon-bounces@xymon.com] <b>On Behalf Of </b>Dominique Frise<br><b>Sent:</b> 25 February 2016 11:00<br><b>To:</b> xymon@xymon.com<br><b>Subject:</b> [Xymon] XymonPSClient and Security eventlog<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p><span style='font-family:"Calibri",sans-serif;color:black'>Hi,<o:p></o:p></span></p><p><span style='font-family:"Calibri",sans-serif;color:black'><o:p> </o:p></span></p><p><span style='font-family:"Calibri",sans-serif;color:black'>Question regarding alerting on Security event_log.<o:p></o:p></span></p><p><span style='font-family:"Calibri",sans-serif;color:black'><o:p> </o:p></span></p><p><span style='font-family:"Calibri",sans-serif;color:black'>Extract from xymonclient.ps1:<o:p></o:p></span></p><p><span style='font-family:"Calibri",sans-serif;color:black'><o:p> </o:p></span></p><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Calibri",sans-serif;color:black'> </span><span style='font-size:9.0pt;font-family:Consolas;color:black'> # default logs - may be overridden by config</span><span style='font-family:"Calibri",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:Consolas;color:black'> $wantedlogs = "Application", "System", "Security"</span><span style='font-family:"Calibri",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:Consolas;color:black'> $wantedLevels = @('Critical', 'Warning', 'Error', 'Information', 'Verbose')</span><span style='font-family:"Calibri",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:Consolas;color:black'> $maxpayloadlength = 1024</span><span style='font-family:"Calibri",sans-serif;color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:Consolas;color:black'> $payload = ''</span><span style='font-family:"Calibri",sans-serif;color:black'><o:p></o:p></span></p></div><p><span style='font-family:"Calibri",sans-serif;color:black'><o:p> </o:p></span></p><p><span style='font-family:"Calibri",sans-serif;color:black'>When problems occurr, "Warning", "Critical or "Error" are reported in Application and System event_log, <o:p></o:p></span></p><p><span style='font-family:"Calibri",sans-serif;color:black'>but in the Security event_log "Audit Failure" will be reported.<o:p></o:p></span></p><p><span style='font-family:"Calibri",sans-serif;color:black'>We don't see how this condition is handled.<o:p></o:p></span></p><p><span style='font-family:"Calibri",sans-serif;color:black'><o:p> </o:p></span></p><p><span style='font-family:"Calibri",sans-serif;color:black'>Did we missed something ?<o:p></o:p></span></p><p><span style='font-family:"Calibri",sans-serif;color:black'><o:p> </o:p></span></p><p><span style='font-family:"Calibri",sans-serif;color:black'>Thanks,<o:p></o:p></span></p><p><span style='font-family:"Calibri",sans-serif;color:black'>Dominique Frise - UNIL<o:p></o:p></span></p></div></body></html>