Support
 
Support Get Quote
 
 
 
 

EventLog Analyzer

Troubleshooting Tips

  • General
    • Where do I find the log files to send to EventLog Analyzer Support?
    • I find that EventLog Analyzer keeps crashing or all of a sudden stops collecting logs. What could be the reason?
    • How to create SIF (Support Information File) and send the file to Manageengine, if you are not able to perform the same from the Web client?
    • How to register dll when message files for event sources are unavailable?
    • What should I do if the network driver is missing?
  • Installation
    • EventLog Analyzer displays "Enter a proper ManageEngine license file" during installation
    • Binding EventLog Analyzer server (IP binding) to a specific interface.
  • Startup and Shut Down
    • MySQL-related errors on Windows machines.
    • EventLog Analyzer displays "Port 8400 needed by EventLog Analyzer is being used by another application. Please free the port and restart EventLog Analyzer" when trying to start the server.
    • EventLog Analyzer displays "Can't Bind to Port <Port Number>" when logging into the UI.
    • Start up and shut down batch files not working on Distributed Edition when taking backup.
    • EventLog Analyzer displays "Couldn't start elasticsearch at port 9300".
  • Configuration
    • While adding device for monitoring, the 'Verify Login' action throws RPC server unavailable error
    • While adding device for monitoring, the 'Verify Login' action throws 'Access Denied' error.
    • When WBEM test is carried out. it fails and shows error message with code 80041010 in Windows Server 2003.
    • How to enable Object Access logging in Linux OS?
    • What are commands to start and stop Syslog Deamon in Solaris 10?
    • While configuring incident management with ServiceDesk, I am facing SSL Connection error.
    • File Integrity Monitoring (FIM) troubleshooting
    • Error statuses in File Integrity Monitoring (FIM).
    • Port management error codes
    • Port already used by some other application
    • TLS not configured
    • PFX not configured
    • External error
    • The event source file(s) configuration throws the "Unable to discover files" error.
  • Log Collection and Reporting
    • I've added a device, but EventLog Analyzer is not collecting event logs from it
    • I get an Access Denied error for a device when I click on "Verify Login" but I have given the correct login credentials
    • I have added an Custom alert profile and enabled it. But the alert is not generated in EventLog Analyzer even though the event has occured in the device machine
    • When I create a Custom Report, I am not getting the report with the configured message in the Message Filter
    • MS SQL server for EventLog Analyzer stopped
    • I successfully configured Oracle device(s), still cannot view the data
    • The Syslog host is not added automatically to EventLog Analyzer/the Syslog reception has suddenly stopped
  • EventLog Analyzer agent management
    • EventLog Analyzer agent management
  • Error messages while adding STIX/TAXII servers to EventLog Analyzer
    • This feature has been disabled for Online Demo!
    • Connection failed. Please try configuring proxy server.
    • Failed to connect to the URL.
    • Authorization failed.
  • SSL Troubleshooting steps
    • Certificate name mismatch.
    • Invalid certificate.
  • Threat Intelligence Troubleshooting Tips
    • IP Geolocation data store corruption
    • IP Geolocation data update failure

General

Where do I find the log files to send to EventLog Analyzer Support?

For Build 8010 onwards

The log files are located in the <EventLogAnalyzer_Home > logs directory. Typically when you run into a problem, you will be asked to send the serverout.txt file from this directory to EventLog Analyzer Support.

For Build 8000 or earlier

The log files are located in the <EventLogAnalyzer_Home > server/default/log directory. Typically when you run into a problem, you will be asked to send the serverout.txt file from this directory to EventLog Analyzer Support.

General

I find that EventLog Analyzer keeps crashing or all of a sudden stops collecting logs. What could be the reason?

The inbuilt PostgreSQL/MySQL database of EventLog Analyzer could get corrupted if other processes are accessing these directories at the same time. So exclude ManageEngine installation folder from

  • Anti-virus scans
  • Automatic backup softwares
  • Snapshots in case of VMware installation

Ensure that no snap shots are taken if the product is running on a VM.

General

How to create SIF (Support Information File) and send it to ManageEngine when you are not able to perform the same from the Web client?

The SIF will help us to analyze the issue you have come across and propose a solution for the same.

If you are unable to create a SIF from the Web client UI,

For Build 8010 onwards

You can zip the files under 'logs' folder, located in C:/ManageEngine/Eventlog/logs (default path) and upload the zip file to the following ftp link: http://bonitas.zohocorp.com/upload/index.jsp?to=eventloganalyzer-support@manageengine.com

For Build 8000 or earlier

You can zip the files under 'log' folder, located in C:/ManageEngineEventlog/server/default/log (default path) and upload the zip file to the following ftp link: http://bonitas.zohocorp.com/upload/index.jsp?to=eventloganalyzer-support@manageengine.com

General

How to register dll when message files for event sources are unavailable?

To register dll, follow the procedure given in the link below: http://ss64.com/nt/regsvr32.html

General

What should I do if the network driver is missing?

For Windows builds 32bit and 64bit:
  • Open the command prompt with the administrative privilege and enter "cd <ELA home>\bin".
  • Enter the command (register-driver "<ELA home> \lib\native") to install all the required network drivers in your system.
  • Reload the Log Receiver page to fetch logs in real-time.

Installation

EventLog Analyzer displays "Enter a proper ManageEngine license file" during installation

This can happen under two instances:

Case 1: Your system date is set to a future or past date. In this case, uninstall EventLog Analyzer, reset the system date to the current date and time, and re-install EventLog Analyzer.

Case 2: You may have provided an incorrect or corrupted license file. Verify that you have applied the license file obtained from ZOHO Corp. If neither is the reason, or you are still getting this error, contact licensing@manageengine.com

Installation

Binding EventLog Analyzer server (IP binding) to a specific interface.

For Build 8010 onwards

To bind EventLog Analyzer server to a specific interface, follow the procedure given below:

For Eventlog Analyzer running as application:
  • Shutdown EventLog Analyzer
  • Open the run.bat file which is under <EventLog Analyzer Home> bin directory and go to "RESTART Command block", uncomment the below RESTART command line and replace <ip-address> with the IP address to which you want to bind the application, comment the existing RESTART command line and save the file.
  • Note :

    rem %JAVA% %JAVA_OPTS% -cp "%CLASS_PATH%" com.adventnet.mfw.Starter %SAFE_START% -c default -b <ip-address>

    to

    %JAVA% %JAVA_OPTS% -cp "%CLASS_PATH%" com.adventnet.mfw.Starter %SAFE_START% -c default -b <ip-address >

    %JAVA% %JAVA_OPTS% -cp "%CLASS_PATH%" com.adventnet.mfw.Starter %SAFE_START%

    to

    rem %JAVA% %JAVA_OPTS% -cp "%CLASS_PATH%" com.adventnet.mfw.Starter %SAFE_START%

  • Open setcommonenv.bat file which is under <EventLog Analyzer Home> bin directory and go to "JAVA_OPTS Setting command Block", uncomment the below JAVA_OPTS setting command line and replace <ip-address> with the IP address to which you want to bind the application and comment the existing JAVA_OPTS setting command.
  • Note :

    rem set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms128m -Xmx512m -Dspecific.bind.address= <ip-address>

    to

    set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms128m -Xmx512m -Dspecific.bind.address= <ip-address >

    set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms256m -Xmx1024m

    to

    rem set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms256m -Xmx1024m

  • Save the file
  • Open the database_param.conf file which is under <EventLog Analyzer Home > conf directory and replace localdevice in url tag with the <binding IP address> to which you want to bind the application and save the file.
  • Note :

    url=jdbc:postgresql://localdevice: 33336/eventlog?stringtype=unspecified

    to

    url=jdbc:postgresql://<binding IP address>:33336/eventlog?stringtype=unspecified

  • Open the postgresql.conf file which is under <EventLog Analyzer Home> pgsqldata directory and uncomment the line '#listen_addresses = 'localdevice'' in the CONNECTIONS AND AUTHENTICATION section and replace the 'localdevice'with the '<binding IP address >' to which you want to bind the application and save the file.
  • #------------------------------------------------------------------------------

    # CONNECTIONS AND AUTHENTICATION

    #------------------------------------------------------------------------------

    # - Connection Settings -

    #listen_addresses = 'localdevice' # what IP address(es) to listen on;

    # comma-separated list of addresses;

    # defaults to 'localdevice'; use '*' for all

    # (change requires restart)

    to

    #------------------------------------------------------------------------------

    # CONNECTIONS AND AUTHENTICATION

    #------------------------------------------------------------------------------

    # - Connection Settings -

    listen_addresses = <binding IP address> # what IP address(es) to listen on;

    # comma-separated list of addresses;

    # defaults to 'localdevice'; use '*' for all

    # (change requires restart)

  • Open the pg_hba.conf file which is under <EventLog Analyzer Home> pgsqldata directory and add the line
    • device all all <binding IP address in IPv4 format> /32 trust
    • after the line
    • device all all 127.0.0.1/32 trust
    • and save the file.
  • # TYPE DATABASE USER ADDRESS METHOD

    # IPv4 local connections:

    device all all 127.0.0.1/32 trust

    # IPv6 local connections:

    device all all ::1/128 trust

    to

    # TYPE DATABASE USER ADDRESS METHOD

    # IPv4 local connections:

    device all all 127.0.0.1/32 trust

    device all all <binding IP address in IPv4 format> /32 trust

    # IPv6 local connections:

    device all all ::1/128 trust

  • Restart EventLog Analyzer
For Eventlog Analyzer running as service:

Before proceeding further, stop the EventLog Analyzer service and make sure that 'SysEvtCol.exe','Postgres.exe' and 'java.exe' are not running.There are 7 files that must be modified for IP binding.

Note: Before editing the files ensure that you have a backup copy of the files.

Assume xxx.xxx.xxx.xxx is the IP address you wish to bind with EventLog Analyzer.

File:1

<ELA home>\bin\setCommonEnv.bat

  • Search for line set JAVA_OPTS=-Djava.library.path=..\lib;..\lib\native -Duser.country=US -Duser.language=en -Xms256m -Xmx1024m
  • Append -Dspecific.bind.address= xxx.xxx.xxx.xxx to the line. It will now look as: set JAVA_OPTS=-Djava.library.path=..\lib;..\lib\native -Duser.country=US -Duser.language=en -Xms256m -Xmx1024m -Dspecific.bind.address= xxx.xxx.xxx.xxx

File:2

<ELA home>\bin\runSEC.bat

  • Search for line "%SERVER_HOME%\bin\SysEvtCol.exe" -port 513 %syslogPort% -dbhome "%dbhome%" -ELAhome "%serverHome%" -loglevel 2 %RelayIP% %IPadd% %IgnoreHost% %IPadd% %*
  • Add -bindip xxx.xxx.xxx.xxx to the line, so that it looks like "%SERVER_HOME%\bin\SysEvtCol.exe" -bindip xxx.xxx.xxx.xxx -port 513 %syslogPort% -dbhome "%dbhome%" -ELAhome "%serverHome%" -loglevel 2 %RelayIP% %IPadd% %IgnoreHost% %IPadd% %*

File:3

<ELA home>\server\conf\wrapper.conf

  • Search for line #wrapper.app.parameter.1=com.adventnet.mfw.Starter
  • Remove the # from the line, it should now look like wrapper.app.parameter.1=com.adventnet.mfw.Starter
  • The next line from current position should be #wrapper.app.parameter.2=-L../lib/AdventNetDeploymentSystem.jar . Add the following two lines after this line, one after the other.
    • wrapper.app.parameter.2=-b xxx.xxx.xxx.xxx
    • wrapper.app.parameter.3=-Dspecific.bind.address= xxx.xxx.xxx.xxx
  • The block should now look like this :-

wrapper.app.parameter.1=com.adventnet.mfw.Starter

#wrapper.app.parameter.2=-L../lib/AdventNetDeploymentSystem.jar

wrapper.app.parameter.2=-b xxx.xxx.xxx.xxx

wrapper.app.parameter.3=-Dspecific.bind.address= xxx.xxx.xxx.xxx

File:4

<ELA home>\conf\server.xml

Search for the following block:

<Connector SSLEnabled="false" URIEncoding="UTF-8" acceptCount="100" address="0.0.0.0" clientAuth="false" compressableMimeType="text/html,text/xml" compression="force" compressionMinSize="1024" connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false" maxSpareThreads="75" maxThreads="150" minSpareThreads="25" name="WebServer" noCompressionUserAgents="gozilla, traviata" port="8400" protocol="HTTP/1.1" scheme="http" secure="false"/>

  • Replace address= "0.0.0.0" with address= "xxx.xxx.xxx.xxx"
  • It should now look like the following

<Connector SSLEnabled="false" URIEncoding="UTF-8" acceptCount="100" address="xxx.xxx.xxx.xxx" clientAuth="false" compressableMimeType="text/html,text/xml" compression="force" compressionMinSize="1024" connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false" maxSpareThreads="75" maxThreads="150" minSpareThreads="25" name="WebServer" noCompressionUserAgents="gozilla, traviata" port="8400" protocol="HTTP/1.1" scheme="http" secure="false"/>

File:5

<ELA home>\conf\database_params.conf

  • Search for the line url=jdbc:postgresql://127.0.0.1:33335/eventlog?stringtype=unspecified
  • Replace the 127.0.0.1 with your xxx.xxx.xxx.xxx, the line should now look like url=jdbc:postgresql://xxx.xxx.xxx.xxx:33335/eventlog?stringtype=unspecified

File:6

<ELA home>\pgsql\data\postgresql.conf

  • Search for the line #listen_addresses = 'localhost'
  • Remove the # from the line.
  • Replace the 'localhost' with 'xxx.xxx.xxx.xxx', the line should now look like listen_addresses = 'xxx.xxx.xxx.xxx'

File:7

<ELA home>\pgsql\data\pg_hba.conf

Search for the following block

IPv4 local connections:

host all all 127.0.0.1/32 trust

We need to replicate the host all all 127.0.0.1/32 trust line with the new IP address in place of 127.0.0.1 and add it after that line. For replication, please copy this line itself and paste it in next line and then edit out the IP address.

It should look like this

IPv4 local connections:

host all all 127.0.0.1/32 trust

host all all xxx.xxx.xxx.xxx/32 trust

Start EventLog Analyzer and check <ELA home> \logs\wrapper.log for the current status.

For Build 8000 or earlier

To bind EventLog Analyzer server to a specific interface follow the procedure given below:

For Eventlog Analyzer running as application:
  • Open the runSEC.exe/sh file.
  • Add the following parameter in the line in any place before %* or $*: binSysEvtCol.exe -loglevel 3 -port 513 514 %* -bindip <IP Address of the interface to which the EventLog Analyzer needs to be bound>
Example entry is as given below:

binSysEvtCol.exe -loglevel 3 - bindip 192.168.111.153 -port 513 514 %*

For Eventlog Analyzer running as service:
  • Stop the Eventlog Analyzer service.
  • Open the startDB.bat file which is under <Eventlog Analyzer Home> bin directory, add option '--bind-address= <ip-address> ' in the mysqld start command that starts with @start and save the file.
  • Open the stopDB.bat file which is under <Eventlog Analyzer Home> bin directory, add '-h <ip-address>' to the command arguments and save the file.
  • After the change the line should like the one given below:

    set commandArgs=-P %PORT% -u %USER_NAME% -h <ip-address>

  • Open the wrapper.conf file which is under <Eventlog Analyzer Home>server/default/conf and follow the below steps:
  • Uncomment the second application parameter ' wrapper.app.parameter.2=-L../lib/AdventNetDeploymentSystem.jar'.

    Add the following new application parameters

    wrapper.app.parameter.3=-c default

    wrapper.app.parameter.4=-b <ip-address>

    wrapper.app.parameter.5=-Dspecific.bind.address=<ip-address>

    and save the file.

    Note: Remove #'symbol for uncommenting in the .conf file.

  • Open the mysql-ds.xml file which is under <Eventlog Analyzer Home>server/default/deploy directory, replace 'localdevice' in connection-url tag with the <ip-address> to which you want to bind the application and save the file.
  • Start the Eventlog Analyzer service.
  • Verify the setting by executing the 'netstat -ano' command in the command prompt.

Startup and Shut Down

MySQL-related errors on Windows machines

  • Probable cause:

    An instance of MySQL is already running on this machine.
  • Solution: Shut down all instances of MySQL and then start the EventLog Analyzer server.

  • Probable cause:

    Port 33335 is not free
  • Solution: Kill the other application running on port 33335. If you cannot free this port, then change the MySQL port used in EventLog Analyzer.

Startup and Shut Down

EventLog Analyzer displays "Port 8400 needed by EventLog Analyzer is being used by another application. Please free the port and restart EventLog Analyzer" when trying to start the server

Probable cause: The default web server port used by EventLog Analyzer is not free.

Solution:

Kill the other application running on port 8400. Carry out the following steps.

  • Stop the EventLog Analyzer service
  • For Build 8010 onwards, open wrapper.conf which is available under <EventLog Analyzer Home> server/conf folder. For Build 8000 or earlier, open wrapper.conf which is available under <EventLog Analyzer Home> server/default/conf folder.
  • Append the below line under # Java Additional Parameters section,

wrapper.java.additional.21=-Djava.net.preferIPv4Stack=true

Before adding:

wrapper.java.additional.20=-Dorg.tanukisoftware.wrapper.WrapperManager.mbean=false

After adding:

wrapper.java.additional.20=-Dorg.tanukisoftware.wrapper.WrapperManager.mbean=false

wrapper.java.additional.21=-Djava.net.preferIPv4Stack=true

  • Start EventLog Analyzer service

If you cannot free this port, then change the web server port used in EventLog Analyzer.

Startup and Shut Down

EventLog Analyzer displays "Can't Bind to Port <Port Number>"when logging into the UI.

Probable cause:The syslog listener port of EventLog Analyzer is not free.

Solution:
  • Check for the process that is occupying the syslog listener port,using netstat -anp -pudp. And if possible, try to free up this port.
  • If you have started the server in UNIX machines, please ensure that you start the server as a root user.
  • or, configure EventLog Analyzer to listen to a different syslog listener port and ensure that all your configured devices send their syslog to the newly configured syslog listener port of EventLog Analyzer.

Startup and Shut Down

Start up and shut down batch files not working on Distributed Edition when taking backup.

Probable cause: Path names given incorrectly.

Solution:

  • Download the ""Automated.zip and extract the files "startELAservice.bat"and "stopELAservice.bat" to <ELA home> //bin/ folder.
  • Create a Windows schedule as per your requirement and ensure that the path should be <ELA Home>//bin folder.
  • If you would like to have the files to a different folder, you need to edit the downloaded files and give the absolute path as below: <eg.is the application is installed on e:\ >
  • e:\ManageEngine\EventLog\bin\wrapper.exe -p ..\server\conf\wrapper.conf ---> to stop the EventLog Analyzer service.
  • e:\ManageEngine\EventLog\bin\wrapper.exe -t ..\server\conf\wrapper.conf ---> to start the EventLog Analyzer service.
  • Note: The script will work only if the application is started as a service.

Startup and Shut Down

EventLog Analyzer displays "Couldn't start elasticsearch at port 9300".

Probable cause: requiretty is not disabled

Solution: To disable requiretty, please replace requiretty with !requiretty in the etc/sudoers file.

Note: Elasticsearch uses multiple thread pools for different types of operations. It is important for new threads to be created whenever necessary. Please make sure that the number of threads that an elasticsearch user can create is at least 4096 by setting ulimit -u 4096 as root before starting Elasticsearch or by adding elasticsearch - nproc 4096 in /etc/security/limits.conf.

Configuration

While adding device for monitoring, the 'Verify Login' action throws RPC server unavailable error

The probable reason and the remedial action is:

Probable cause: The device machine RPC (Remote Procedure Call) port is blocked by any other Firewall.

Solution: Unblock the RPC ports in the Firewall.

Configuration

While adding device for monitoring, the 'Verify Login' action throws 'Access Denied' error.

The probable reasons and the remedial actions are:

Probable cause: The device machine is not reachable from EventLog Analyzer machine.

Solution: Check the network connectivity between device machine and EventLog Analyzer machine, by using PING command.

Probable cause: The device machine running a System Firewall and REMOTEADMIN service is disabled.

Solution:Check whether System Firewall is running in the device. If System Firewall is running, execute the following command in the command prompt window of the device machine:

netsh firewall set service type=REMOTEADMIN mode=ENABLE profile=all

Configuration

When WBEM test is carried out. it fails and shows error message with code 80041010 in Windows Server 2003.

The probable reasons and the remedial actions are:

Probable cause: By default, WMI component is not installed in Windows 2003 Server

Solution: Win32_Product class is not installed by default on Windows Server 2003. To add the class, follow the procedure given below:

  • In Add or Remove Programs, click Add/Remove Windows Components.
  • In the Windows Components Wizard, select Management and Monitoring Tools,then click Details.
  • In the Management and Monitoring Tools dialog box, select WMI Windows Installer Provider and then click OK.
  • Click Next.

Configuration

How to enable Object Access logging in Linux OS?

The probable reasons and the remedial actions are:

Probable cause:The object access log is not enabled in Linux OS.

Solution:Steps to enable object access in Linux OS, is given below:

  • In the file /etc/xinted.d/wu-ftpd, edit the server arguments as mentioned below:
  • server_args = -i -o -L

Configuration

What are commands to start and stop Syslog Deamon in Solaris 10?

The probable reasons and the remedial actions are:

Probable cause:Unable to start or stop Syslog Daemon in Solaris 10

Solution:In Solaris 10, the commands to stop and start the syslogd daemon are:

  • # svcadm disable svc:/system/system-log:default
  • # svcadm enable svc:/system/system-log:default
  • In Solaris 10, to restart the syslogd daemon and force it to reread /etc/syslog.conf:

  • # svcadm refresh svc:/system/system-log:default
  • or

    # svcadm -v restart svc:/system/system-log:default

Configuration

While configuring incident management with ServiceDesk, I am facing SSL Connection error.

This error can occur if the ServiceDesk server's HTTPS certificate is not included in EventLog Analyzer's JRE certificate store. To import the certificate to EventLog Analyzer's JRE certificate store, follow the steps below:

  • Place the server's certificate in your browser's certificate store by allowing trust when your browser throws up the error saying that the certificate is not trusted.
  • Export the certificate as a binary DER file from your browser.
  • For Firefox, you can find this under Preferences > Advanced > Encryption > Servers
  • For IE, Internet Options > Content > Certificates > Personal > Export
  • For Chrome, Settings > Show Advanced Settings > Manage Certificates
  • Use the keytool utility to import the certificate into EventLog Analyzer's JRE certificate store.
  • keytool -import -alias SDP server -keystore EventLog Analyzer Home /lib/security/cacerts -file path-to-certificate-file Enter the keystore password. Note that the default password is changeit.

Configuration

File Integrity Monitoring (FIM) troubleshooting

Try the following troubleshooting, if username is enabled for a particular folder.

Note: The following GUI is for the SACL entry in folder properties.

Configuration

Error statuses in File Integrity Monitoring (FIM).

1. Permission denied

Causes

  • Credentials maybe incorrect.
  • Credentials with insufficient privileges.

Solutions

  • Credentials can be checked by accessing the SSH terminal.
  • Credentials with the privilege to start, stop, and restart the audit daemon, and also transfer files to the Linux device are necessary.
2. Audit service unavailable

Causes

  • The audit daemon service is not present in the selected Linux device.

Solutions

  • The audit daemon package must be installed along with Audisp.
3. Access restriction from SELinux

Causes

  • SELinux hinders the running of the audit process.

Solutions

  • SELinux's presence could be checked using getenforce command.
  • Configure SELinux in permissive mode. After changing it to the permissive mode, navigate to Manage Agent page and click on Reinstall to reinstall the agent.
4. Agent upgrade failure

Causes

  • No connectivity with the agent during product upgrade.
  • Incorrect credentials.

Solutions

  • Manually install the agent by navigating to the Manage Agent page.
  • To install agent:
    • Windows device: Run the EventLogAgent.msi.
    • Linux device: Execute chmod +x EventLogAgent.bin, then run EventLogAgent.bin.
5. Agent Installation Failed

Causes

  • Machine may be in the offline mode.
  • Machine may not exist.
  • Network path may not be reachable.

Solutions

  • To confirm if the device exists, it could be pinged.
  • Manually install the agent by navigating to the Manage Agent page.
6. Agent Installation on Incompatible Platform
  • The agent is installed on a host which has neither a Linux nor a Windows OS.

Solutions

  • Supported Linux distributions are CentOS, Debian, Fedora, openSUSE, Red Hat, and Ubuntu.
  • Windows versions greater than 5.2 (Windows Server 2003) are supported.

Configuration

Port management error codes

The following are some of the common errors, its causes and the possible solution to resolve the condition. Feel free to contact our support team for any information.

Configuration

Port already used by some other application

Cause: Cannot use the specified port because it is already used by some other application.

Solution: This can be solved either by changing the port in the specified application or by using a new port.If you use a new port, make sure to change the ports in the forwarding device either manually or using auto log forwarding configuration.

Configuration

TLS not configured

Cause: HTTPS not configured to support TLS encrypted logs.

Solution:Configure the server to use either a self-signed certificate or a valid PFX certificate.

For more details visit Connection settings.

Configuration

PFX not configured

Cause: HTTPS is configured, but the type of certificate is not supported.

Solution 1:If no valid certificate is used, it's recommended to use SelfSignedCertificate.

To find the type of certificate used,

  • Open Conf/Server.xml file check for connector tag.
  • Check the extention for the attribute keystoreFile.

Solution 2:If valid KeyStore certificate is used, execute the following command in the <EventLog Analyzer home> /jre/bin terminal.
keytool -importkeystore -srckeystore <certificate path> -destkeystore server.pfx -deststoretype PKCS12 -deststorepass <password> -srcalias tomcat -destalias tomcat

For more details visit Connection settings.

Configuration

External error

Cause: Unknown external issue.

Solution: please contact EventLog Analyzer Technical Support

Configuration

The event source file(s) configuration throws the "Unable to discover files" error.

  • Check the credentials of the machine.
  • Check the connectivity of the device.
  • Ensure that the remote registry service is not disabled.
  • The user should have admin privileges.
  • The open keys and keys with sub-keys cannot be deleted.

Log Collection and Reporting

I've added a device, but EventLog Analyzer is not collecting event logs from it

Probable cause: The device machine is not reachable from the EventLog Analyzer server machine

Solution: Check if the device machine responds to a ping command. If it does not, then the machine is not reachable. The device machine has to be reachable from the EventLog Analyzer server in order to collect event logs.

Probable cause: You do not have administrative rights on the device machine

Solution: Edit the device's details, and enter the Administrator login credentials of the device machine. Click Verify Login to see if the login was successful.

Error Code 0x251C

Probable cause: The device was added when importing application logs associated with it. In this case, only the specified application logs are collected from the device, and the device type is listed as unknown.

Solution:
  • Click on the update icon next to the device name.
  • Select the appropriate device type.
  • Provide any other required information for the selected device type.
  • Click on update.

Log Collection and Reporting

I get an Access Denied error for a device when I click on "Verify Login" but I have given the correct login credentials

Probable cause: There may be other reasons for the Access Denied error.

Solution: Refer the Cause and Solution for the Error Code you got during Verify login.

Error Code 00x80070005

Scanning of the Windows workstation failed due to one of the following reasons:

  1. The login name and password provided for scanning is invalid in the workstation.
  2. Solution: Check if the login name and password are entered correctly.

  3. Remote DCOM option is disabled in the remote workstation
  4. Solution:

    Check if Remote DCOM is enabled in the remote workstation. If not enabled, then enable the same in the following way:

    • Select Start > Run.
    • Type dcomcnfg in the text box and click OK.
    • Select the Default Properties tab.
    • Select the Enable Distributed COM in this machine checkbox.
    • Click OK.

    To enable DCOM on Windows XP devices:

    Select Start > Run

    • Type dcomcnfg in the text box and click OK
    • Click on Component Services > Computers > My Computer
    • Right-click and select Properties
    • Select the Default Properties tab
    • Select the Enable Distributed COM in this machine checkbox
    • Click OK
  5. User account is invalid in the target machine.
  6. Solution: Check if the user account is valid in the target machine by opening a command prompt and executing the following commands:

    net use \ <RemoteComputerName> C$ /u: <DomainNameUserName> "<password>"

    net use \ <RemoteComputerName> ADMIN$ /u: <DomainNameUserName> "<password>"

    If these commands show any errors, the provided user account is not valid on the target machine.

Error Code 0x80041003

The user name provided for scanning does not have sufficient access privileges to perform the scanning operation. This user may not belong to the Administrator group for this device machine.

Solution: Move the user to the Administrator Group of the workstation or scan the machine using an administrator (preferably a Domain Administrator) account.

Error Code 0x800706ba

A firewall is configured on the remote computer. Such exceptions mostly occur in Windows XP (SP 2), when the default Windows firewall is enabled.

Solution:
  1. Disable the default Firewall in the Windows XP machine:
    • Select Start > Run
    • Type Firewall.cpl and click OK
    • In the General tab, click Off
    • Click OK
  2. If the firewall cannot be disabled, launch Remote Administration for administrators on the remote machine by executing the following command:
  3. netsh firewall set service RemoteAdmin After scanning, you can disable Remote Administration using the following command: netsh firewall set service RemoteAdmin disable

Error Code 0x80040154

  1. WMI is not available in the remote windows workstation. This happens in Windows NT. Such error codes might also occur in higher versions of Windows if the WMI Components are not registered properly.
  2. Solution: Install WMI core in the remote workstation.
  3. WMI Components are not registered.
  4. Solution: Register the WMI DLL files by executing the following command in the command prompt:
    winmgmt /RegServer

Error Code 0x80080005

There is some internal execution failure in the WMI service (winmgmt.exe) running in the device machine. The last update of the WMI Repository in that workstation could have failed.

Solution:

Restart the WMI Service in the remote workstation:

  • Select Start > Run
  • Type Services.msc and click OK
  • In the Services window that opens, select Windows Management Instrumentation service.
  • Right-click and select Restart

For any other error codes, refer the MSDN knowledge base.

Log Collection and Reporting

I have added an Custom alert profile and enabled it. But the alert is not generated in EventLog Analyzer even though the event has occured in the device machine

Probable cause: The alert criteria have not been defined properly

Solution: Please ensure that the required fields in the Add Alert Profile screen have been given properly.Check if the e-mail address provided is correct. Ensure that the Mail server has been configured correctly.

Log Collection and Reporting

When I create a Custom Report, I am not getting the report with the configured message in the Message Filter

Probable cause: The message filters have not been defined properly

Solution: When you are entering the string in the Message Filters for matching with the log message, ensure you copy/enter the exact string as shown in the Windows Event Viewer.

e.g., Logon Name:John

Log Collection and Reporting

MS SQL server for EventLog Analyzer stopped

Probable cause: The transaction logs of MS SQL could be full

Solution: If the EventLog Analyzer MS SQL database transaction logs are full, shrink the same with the procedure given below:

  • Stop the Eventlog Analyzer Server/Service (Check the Eventlog Analyzer server machine's Task Manager to ensure that the processes 'SysEvtCol.exe', 'Java.exe' are not running).
  • Connect MS SQL client (using Microsoft SQL Server Management Studio) and execute the below query:
  • sp_dboption 'eventlog', 'trunc. log on chkpt.', 'true'

    To execute the query, select and highlight the above command and press F5 key.

  • After executing the above command, select and highlight the below command and press F5 key to execute it.
  • DBCC SHRINKDATABASE (eventlog)

  • Note: This process will take some time, based on the EventLog Analyzer database size.
  • Start the Eventlog Analyzer.

Log Collection and Reporting

I successfully configured Oracle device(s), still cannot view the data

If Oracle device is Windows, open Event viewer in that machine and check for Oracle source logs under Application type. If Linux, check the appropriate log file to which you are writing Oracle logs. If the Oracle logs are available in the specified file, still EventLog Analyzer is not collecting the logs, contact EventLog Analyzer Support.

The user name provided for scanning does not have sufficient access privileges to perform the scanning operation. Probably, this user does not belong to the Administrator group for this device machine

Log Collection and Reporting

The Syslog host is not added automatically to EventLog Analyzer/the Syslog reception has suddenly stopped

Check EventLog Analyzer's live Syslog Viewer for incoming Syslog packets.

If you are able to view the logs, it means that the packets are reaching the machine, but not to EventLog Analyzer. You need to check your Windows firewall or Linux IP tables.

If you are not able to view the logs in the Syslog viewer, then check if the EventLog Analyzer server is reachable. This can be done in the following ways:

  • Ping the server.
  • For TCP, you can try the command telnet <ela_server_name> <port_no> where 514 is the default TCP port.
  • tcpdump
  • tcpdump -n dst <ela_server_name> and dst port <port_no>

If reachable, it means there was some issue with the configuration. If not reachable, then you are facing a network issue.

EventLog Analyzer agent management

If you have trouble installing the agent using the EventLog Analyzer console, GPOs or software installation tools, you can try to install the agent manually. Here the the steps for manual agent installation.

Error messages while adding STIX/TAXII servers to EventLog Analyzer

This feature has been disabled for Online Demo!

This error message pops up when the feature you tried to use is not available in the online demo version of EventLog Analyzer. To try out that feature, download the free version of EventLog Analyzer.

Error messages while adding STIX/TAXII servers to EventLog Analyzer

Connection failed. Please try configuring proxy server.

This error message can be caused because of different reasons. It might be due to network issues, proxy related issues, bad requests in the network, or if the URL is unable to locate a STIX/TAXII server.

Error messages while adding STIX/TAXII servers to EventLog Analyzer

Failed to connect to the URL.

This error message denotes that the URL entered is malformed.

Error messages while adding STIX/TAXII servers to EventLog Analyzer

Authorization failed.

This error message signifies that the credentials entered are wrong.

SSL Troubleshooting steps

Certificate name mismatch.

Description:

This error occurs when the common name of the SSL Certificate doesn't exactly match the hostname of the server in which the EventLog Analyzer is installed.

Solution:

Please get a new SSL certificate for the current hostname of the server in which EventLog Analyzer is installed.

SSL Troubleshooting steps

Invalid Certificate

Description:

This error occurs when the SSL certificate you have configured with EventLog Analyzer is invalid. A certificate can become invalid if it has expired or other reasons.

Solution:

Please configure EvnetLog analyzer to use a valid SSL certificate.

Threat Intelligence Troubleshooting Tips

IP Geolocation data store corruption

This may happen when the product is shutdowns while the data store is updating and there is no backup available.

Troubleshooting steps:

  • This is a rare scenario and it happens only when the product shuts down abruptly during the first ever download of IP geolocation data.
  • There is no need for a troubleshoot as EventLog Analyzer will automatically download the data in the next schedule. Please note that the IP geolocation data gets automatically updated daily at 21:00 hours.

Threat Intelligence Troubleshooting Tips

IP Geolocation data update failure

This occurs when there is no internet connection on EventLog Analyzer server or if the server is unreachable.

Troubleshooting steps:

  • Make sure you have a working internet connection.
  • Whitelist https://creator.zoho.com in your firewall.

EventLog Analyzer Trusted By

Los Alamos National Bank Michigan State University
Panasonic Comcast
Oklahoma State University IBM
Accenture Bank of America
Infosys
Ernst Young

Customer Speaks

  • Credit Union of Denver has been using EventLog Analyzer for more than four years for our internal user activity monitoring. EventLog Analyzer provides great value as a network forensic tool and for regulatory due diligence. This product can rapidly be scaled to meet our dynamic business needs.
    Benjamin Shumaker
    Vice President of IT / ISO
    Credit Union of Denver
  • The best thing, I like about the application, is the well structured GUI and the automated reports. This is a great help for network engineers to monitor all the devices in a single dashboard. The canned reports are a clever piece of work.
    Joseph Graziano, MCSE CCA VCP
    Senior Network Engineer
    Citadel
  • EventLog Analyzer has been a good event log reporting and alerting solution for our information technology needs. It minimizes the amount of time we spent on filtering through event logs and provides almost near real-time notification of administratively defined alerts.
    Joseph E. Veretto
    Operations Review Specialist
    Office of Information System
    Florida Department of Transportation
  • Windows Event logs and device Syslogs are a real time synopsis of what is happening on a computer or network. EventLog Analyzer is an economical, functional and easy-to-utilize tool that allows me to know what is going on in the network by pushing alerts and reports, both in real time and scheduled. It is a premium software Intrusion Detection System application.
    Jim Lloyd
    Information Systems Manager
    First Mountain Bank

Awards and Recognitions

  •  
  •  
  •  
  •  
  •  
  •  
  •  
  •  
  •  
  •  
A Single Pane of Glass for Comprehensive Log Management