RE: Event Manager 7 Report pack not showing events
|
Logged in as: Guest
|
|
Users viewing this topic:
none
|
|
Login  | |
|
RE: Event Manager 7 Report pack not showing events - 7.Nov.2006 3:16:21 AM
|
|
|
PCPlumber
Posts: 14
Score: 0
Joined: 25.Oct.2006
Status: offline
|
There has been no activity since 4:30 this afternoon. At around 4:00 I noticed there was no acitivity, so I restarted the service, nothing happened. I then rebooted the server, still nothing. At around 4:30, I saw some batch of activity. Some alert was also sent out at that time. That was the last of the acitivties.
Please note, it was not doing that before I upgraded to the CTP build. although it was not showing locked out or failed logon for dcs, log collecting and reporting were working.
|
|
|
|
|
RE: Event Manager 7 Report pack not showing events - 7.Nov.2006 3:50:04 AM
|
|
|
Arielle
Posts: 294
Score: 0
Joined: 15.Sep.2006
Status: offline
|
Hi,
We would like to investigate this issue further. In order to do this we would need some debug logs.
Can you please run the troubleshooter (Start > All Programs > GFI EventsManager 7 > Troubleshooter), ZIP the output files and send them to forums@gfi.com or support@gfi.com referencing this thread in the email.
Thanks
_____________________________
Arielle Bonnici - Quality Metrics Analyst
GFI Software - www.gfi.com
|
|
|
|
|
RE: Event Manager 7 Report pack not showing events - 7.Nov.2006 5:28:51 AM
|
|
|
Arielle
Posts: 294
Score: 0
Joined: 15.Sep.2006
Status: offline
|
Hi,
Can you please check that the GFI EventsManager service is running under an account that has administrative priviledges?
1. Start > Run > services.msc
2. Right click on GFI EventsManager and select 'Properties'
3. On the 'Log On' tab make sure that the service is using the right account
_____________________________
Arielle Bonnici - Quality Metrics Analyst
GFI Software - www.gfi.com
|
|
|
|
|
RE: Event Manager 7 Report pack not showing events - 7.Nov.2006 12:11:40 PM
|
|
|
PCPlumber
Posts: 14
Score: 0
Joined: 25.Oct.2006
Status: offline
|
It looks like the serive hung. I was not able to restart the service, so I rebooted the server. GFI is now showing events again.
|
|
|
|
|
RE: Event Manager 7 Report pack not showing events - 7.Nov.2006 6:36:08 PM
|
|
|
PCPlumber
Posts: 14
Score: 0
Joined: 25.Oct.2006
Status: offline
|
H Calin,
The problem was related to the EventManager service stopped unexpectely.
I call support and was told it was dued to anti-virus or backup software conflicts. I am not running backup on this server, and I have disabled all anti-virus, and GFI still stops. When it stops, I see no activity. I start the service, and there are activities, but the service would not stay running.
This only happens after I've upgraded to the CTP version.
Any help is appreciated.
Peter
|
|
|
|
|
RE: Event Manager 7 Report pack not showing events - 8.Nov.2006 2:44:36 AM
|
|
|
Calin Ghibu
Posts: 1194
Score: 0
Joined: 15.Dec.2002
Status: offline
|
Hi Peter,
Can you please check out the account used by the EventsManager service? Is it member of domain admins users or local admins users (in case you are working in a workgroup environment)?
This is a concern especially since the troubleshooter found the account to be not according to the requirements.
Do you have any firewall on the machine running EventsManager?
Best regards,
Calin
|
|
|
|
|
RE: Event Manager 7 Report pack not showing events - 8.Nov.2006 3:02:14 AM
|
|
|
PCPlumber
Posts: 14
Score: 0
Joined: 25.Oct.2006
Status: offline
|
Yes. The account in used in part of domain admin as well as local admin
Windows firewall is enabled on this machine.
|
|
|
|
|
RE: Event Manager 7 Report pack not showing events - 8.Nov.2006 5:34:33 AM
|
|
|
Calin Ghibu
Posts: 1194
Score: 0
Joined: 15.Dec.2002
Status: offline
|
ok,
Ok, first make sure that the ports/processes required by EventsManager are configured as exceptions in Windows Firewall and exceptions are enabled (http://kbase.gfi.com/showarticle.asp?id=KBID002770).
Then please try the following.
Logon using the account used by the EventsManager service.
Run -> regedt32
Select File ->Connect to network registry
Select one of the target machines.
Are you able to connect to the remote registry on the target machines?
Best regards,
Calin
|
|
|
|
|
RE: Event Manager 7 Report pack not showing events - 13.Nov.2006 7:17:00 AM
|
|
|
zimbo
Posts: 2
Score: 0
Joined: 13.Nov.2006
Status: offline
|
Hi
We have recently upgraded to version 7 and have the same problem - set up to monitor one server for account lockouts (Event644) and to email when the event is logged, this works for a while (a day maybe)and then just stops. No errors logged in local event logs.
The server being monitored is real time, and I have moved the 'Security' rule set to the top of the list - ie top priority, with only the 'Monitoring and Attack Detection' group of rules enabled - which includes my 644 event rule to email me. The server is windows 2003 R2, no firewalls anywhere, local install of SQL2005 database in use (not big - 28MB and small transcation log - 1mb). Antivirus installed is McAffee Virusscan 8. Running the troubleshooter utility tells me the 'processor service' does not have sufficient permissions, I assume the processor service is the 'GFI EventsManager' service - this has full domain admin and local admin rights. And its does work - at least for a while so I cant see it being a permissions issue??
GFI - Help! I have not yet installed the new interim build (2006_10_27_eventsmanager7.exe), but earlier posts suggest this does not help?
One other thing:
The Activity Overview section on the main status page in the management console does not relect the correct 'Last Activity Time'. If you remain in the console the last activity time updates as expected - if however you close the console window and open it again the 'Last Activity time' for the monitored server sets back to the day I added it to the Event monitor. I contacted the chat support - they said this is by design?
I will be contacting the support line again.
|
|
|
|
|
RE: Event Manager 7 Report pack not showing events - 15.Nov.2006 3:39:53 AM
|
|
|
Arielle
Posts: 294
Score: 0
Joined: 15.Sep.2006
Status: offline
|
Hi,
Please download and install the CTP build from http://ctp.gfi.com/2006_10_27_EventsManager7.exe, it should fix your issue with 644 events.
The 'Last Activity' date/time will not update if there are problems connecting to the database, and a database connection problem will also prevent any events to get to the database.
Let us know if the new build fixes your problem.
_____________________________
Arielle Bonnici - Quality Metrics Analyst
GFI Software - www.gfi.com
|
|
|
|
|
RE: Event Manager 7 Report pack not showing events - 15.Nov.2006 11:32:52 AM
|
|
|
tdeering
Posts: 51
Score: 0
Joined: 19.Dec.2005
Status: offline
|
I have upgraded to the recommended build, but events stop processing. I have even added a script to stop and start the service (which helped), but when the process restarts it gathers some events that were gathered before so I have the same event twice in the database. I do not have a firewall on the machine and antivirus excludes the recommended directories.
|
|
|
|
|
RE: Event Manager 7 Report pack not showing events - 17.Nov.2006 3:51:39 AM
|
|
|
zimbo
Posts: 2
Score: 0
Joined: 13.Nov.2006
Status: offline
|
I have disabled every event processing rule except the one that alerts me to account lockouts. It is only monitoring one server. And it has been working fine for the past few days. I will leave it in this config until next week and will then start to enable further rules and see if it remains stable. I have not yet upgraded to the 2006_10_27_eventsmanager7.exe version yet - but looks like it wont help from the pervious post....
|
|
|
|
|
RE: Event Manager 7 Report pack not showing events - 17.Nov.2006 5:46:44 AM
|
|
|
Arielle
Posts: 294
Score: 0
Joined: 15.Sep.2006
Status: offline
|
FYI, next week we will be uploading a new CTP build that will contain all the fixes related to the rule system.
_____________________________
Arielle Bonnici - Quality Metrics Analyst
GFI Software - www.gfi.com
|
|
|
|
|
RE: Event Manager 7 Report pack not showing events - 20.Nov.2006 10:19:25 AM
|
|
|
andrew6123
Posts: 19
Score: 0
Joined: 17.Nov.2006
Status: offline
|
I have the same problem. My Languard installation when crazy and I upgraded to Events Manager 7. Because of this issue I have no monitoring, is there an ETA for the fix of this issue or should I start the reinstall of the LanGuard
|
|
|
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
 Locked w/ New Messages |
 Locked w/o New Messages |
|
 Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts |
|
|
Printable Version
