EM causing 675 events

	Forums Register Login My Profile Inbox Address Book My Subscription My Forums Member List Search FAQ Ticket List Log Out

EM causing 675 events

Logged in as: Guest

Users viewing this topic: none

Printable Version

All Forums >> [Networking & Security] >> GFI EventsManager >> EM causing 675 events

Page: [1]

Message

<< Older Topic Newer Topic >>

EM causing 675 events - 13.Aug.2009 10:23:40 AM

dhartley

Posts: 11
Score: 0
Joined: 2.Feb.2006
Status: offline

Events Manager seems to be causing alot of 675 events on one of my domain controllers. I've verified this by disabling all non-MS services and adding them back one by one. The events resumed after allowing the Events Manager service to start.

Events Manager version is 8.2.

The account associated with the 675 events never becomes locked though. The account also is not set for Events Manager to use to start the service or in Events Manager for it to use for log collection.

Thanks

< Message edited by dhartley -- 13.Aug.2009 10:45:01 AM >

Post #: 1

RE: EM causing 675 events - 13.Aug.2009 10:46:28 AM

DrewE

Posts: 1058
Score: 0
Joined: 28.Apr.2008
From: Cary, NC
Status: offline

Is the account listed in the 675 events the same account the GFI EventsManager service is using?

_____________________________

Drew Easley - Technical Support Representative
GFI Software - www.gfi.com

(in reply to dhartley)

Post #: 2

RE: EM causing 675 events - 13.Aug.2009 12:22:52 PM

dhartley

Posts: 11
Score: 0
Joined: 2.Feb.2006
Status: offline

No, like I said, Events Manager isn't utilizing this account to run or to collect logs. It's not setup to at least. The log collection credentials are set to use the same as the service. The DC where the events are occurring is set to inherit from the group it is in. Edited version of the error below.

Pre-authentication failed:
    User Name:    non EM user acct
    User ID:        domain\non EM user acct
    Service Name:    krbtgt/domain
    Pre-Authentication Type:    0x2
    Failure Code:    0x18
    Client Address:    Server with EM running on it

< Message edited by dhartley -- 13.Aug.2009 3:09:10 PM >

(in reply to DrewE)

Post #: 3

RE: EM causing 675 events - 13.Aug.2009 3:31:26 PM

DrewE

Posts: 1058
Score: 0
Joined: 28.Apr.2008
From: Cary, NC
Status: offline

From Configuration -> Event Sources: Do you have any machines or groups setup with alternative credentials that might be using this account?

_____________________________

Drew Easley - Technical Support Representative
GFI Software - www.gfi.com

(in reply to dhartley)

Post #: 4

RE: EM causing 675 events - 14.Aug.2009 7:18:19 AM

dhartley

Posts: 11
Score: 0
Joined: 2.Feb.2006
Status: offline

All groups use the service account and all machines inherit from their group. One machine is an exception to that but it has credentials different than the service or the account related to the 675 events.

(in reply to DrewE)

Post #: 5

RE: EM causing 675 events - 14.Aug.2009 7:54:38 AM

DrewE

Posts: 1058
Score: 0
Joined: 28.Apr.2008
From: Cary, NC
Status: offline

We will need to investigate a full set of debug logs regarding this so we can best assist you. Will you please open a support request at http://support.gfi.com/Support/support.aspx?lcode=en

_____________________________

Drew Easley - Technical Support Representative
GFI Software - www.gfi.com

(in reply to dhartley)

Post #: 6