<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hi,<br>
</p>
<p><br>
</p>
<p>Question regarding alerting on Security event_log.</p>
<p><br>
</p>
<p>Extract from xymonclient.ps1:</p>
<p><br>
</p>
<div><span style="font-size: 9pt;"> <span style="font-family: Consolas, monospace;"> # default logs - may be overridden by config</span><br style="font-family: Consolas, monospace;">
</span></div>
<div><span style="font-size: 9pt; font-family: Consolas, monospace;"><span style="font-family: Consolas, monospace;"> $wantedlogs = "Application", "System", "Security"</span></span></div>
<div><span style="font-size: 9pt; font-family: Consolas, monospace;"><span style="font-family: Consolas, monospace;"> $wantedLevels = @('Critical', 'Warning', 'Error', 'Information', 'Verbose')</span></span></div>
<div><span style="font-size: 9pt; font-family: Consolas, monospace;"><span style="font-family: Consolas, monospace;"> $maxpayloadlength = 1024</span></span></div>
<div><span style="font-size: 9pt; font-family: Consolas, monospace;"><span style="font-family: Consolas, monospace;"> $payload = ''</span></span><br>
</div>
<p><br>
</p>
<p>When problems occurr, "Warning", "Critical or "Error" are reported in Application and System event_log, <br>
</p>
<p>but in the Security event_log "Audit Failure" will be reported.<br>
</p>
<p>We don't see how this condition is handled.<br>
</p>
<p><br>
</p>
<p>Did we missed something ?<br>
</p>
<p><br>
</p>
<p>Thanks,<br>
</p>
<p>Dominique Frise - UNIL<br>
</p>
</body>
</html>