Events Manager not showing Failure Audits

	Forums Register Login My Profile Inbox Address Book My Subscription My Forums Member List Search FAQ Ticket List Log Out

Events Manager not showing Failure Audits

Logged in as: Guest

Users viewing this topic: none

Printable Version

All Forums >> [Networking & Security] >> GFI EventsManager >> Events Manager not showing Failure Audits

Page: [1]

Message

<< Older Topic Newer Topic >>

Events Manager not showing Failure Audits - 29.Jul.2009 9:40:15 AM

mwolfe

Posts: 3
Score: 0
Status: offline

Hello,

I am evaulating Events Manager 8.2.0.

Our installation is currently configured to monitor the event log on 5 of our domain controllers.

At the time of installation, we were not logging security failure audits.

I have since enable logging of failure audits, and am able to see them in event viewer on each of our DCs.

However, GFI EM does not appear to be picking them up. It has been over 24 hours since I made the GPO change.

I am trying to view the failure audits in events browser under security events. I created two new queries, one called Success Audits (matching on type = success audit) and one called Failure Audits (matching on type = failure audit).

The Success Audits query has over a million events, and the Failure Audits query has 0.

Any suggestions? Thanks!

Post #: 1

RE: Events Manager not showing Failure Audits - 29.Jul.2009 9:43:33 AM

mwolfe

Posts: 3
Score: 0
Status: offline

Thanks!

< Message edited by mwolfe -- 29.Jul.2009 9:55:34 AM >

(in reply to mwolfe)

Post #: 2

RE: Events Manager not showing Failure Audits - 29.Jul.2009 9:55:04 AM

DrewE

Posts: 1058
Score: 0
Joined: 28.Apr.2008
From: Cary, NC
Status: offline

What operating system is the GFI EventsManager installed on? Also, what OS are you trying to collect events from?

_____________________________

Drew Easley - Technical Support Representative
GFI Software - www.gfi.com

(in reply to mwolfe)

Post #: 3

RE: Events Manager not showing Failure Audits - 29.Jul.2009 9:58:31 AM

mwolfe

Posts: 3
Score: 0
Status: offline

GFI EM is currently running on an XP Pro workstation. The DCs we are monitoring are all Windows 2003, Enterprise Edition, SP2.

Thanks

(in reply to DrewE)

Post #: 4

RE: Events Manager not showing Failure Audits - 30.Jul.2009 8:36:25 AM

DrewE

Posts: 1058
Score: 0
Joined: 28.Apr.2008
From: Cary, NC
Status: offline

We will need to see a full set of debug logs regarding this incident so we can best assist you. Will you please open a support request online at http://support.gfi.com/Support/support.aspx?lcode=en so we can further see what is occurring?

_____________________________

Drew Easley - Technical Support Representative
GFI Software - www.gfi.com

(in reply to mwolfe)

Post #: 5