EventLog Analyzer - Troubleshooting Tips

General

Where do I find the log files to send to EventLog Analyzer Support?

For Build 8010 onwards

The log files are located in the <EventLogAnalyzer_Home>logs directory. Typically when you run into a problem, you will be asked to send the serverout.txt file from this directory to EventLog Analyzer Support.

For Build 8000 or earlier

The log files are located in the <EventLogAnalyzer_Home>server/default/log directory. Typically when you run into a problem, you will be asked to send the serverout.txt file from this directory to EventLog Analyzer Support.

I find that EventLog Analyzer keeps crashing or all of a sudden stops collecting logs. What could be the reason?

The inbuilt PostgreSQL/MySQL database of EventLog Analyzer could get corrupted if other processes are accessing these directories. So exclude ManageEngine installation folder from

• Anti-virus scans
• Automatic backup softwares
• Snapshots in case of VMware installation

Ensure that there should not be any snap shots if the product is running on a VM.

How to create SIF (Support Information File) and send the file to Manageengine, if you are not able to perform the same from the Web client?

For Build 8010 onwards

The SIF will help us to analyze the issue you have come across and propose a solution. If you are unable to create a SIF from the Web client UI, you can zip the files under 'logs' folder, which is located in C:/ManageEngine/Eventlog/logs (default path) and send the zip file by upload it in the following ftp link: http://bonitas.zohocorp.com/upload/index.jsp?to=eventloganalyzer-support@manageengine.com 

For Build 8000 or earlier

The SIF will help us to analyze the issue you have come across and propose a solution. If you are unable to create a SIF from the Web client UI, you can zip the files under 'log' folder, which is located in C:/ManageEngineEventlog/server/default/log (default path) and send the zip file by upload it in the following ftp link: http://bonitas.zohocorp.com/upload/index.jsp?to=eventloganalyzer-support@manageengine.com

How to register dll when message files for event sources are unavailable?

To register dll, follow the procedure given in the link below: http://ss64.com/nt/regsvr32.html

Installation

EventLog Analyzer displays "Enter a proper ManageEngine license file" during installation

This message could be shown in two cases:

Case 1: Your system date is set to a future or past date. In this case, uninstall EventLog Analyzer, reset the system date to the current date and time, and re-install EventLog Analyzer.
Case 2: You may have provided an incorrect or corrupted license file. Verify that you have applied the license file obtained from ZOHO Corp.
If neither is the reason, or you are still getting this error, contact licensing@manageengine.com

Unable to bind EventLog Analyzer server to a specific interface.

For Build 8010 onwards

To bind EventLog Analyzer server to a specific interface follow the procedure given below:

For Eventlog Analyzer running as application:

• Shutdown EventLog Analyzer
• Open the run.bat file which is under <EventLog Analyzer Home>bin directory and go to "RESTART Command block", uncomment the below RESTART command line and replace <ip-address> with the IP address to which you want to bind the application, comment the existing RESTART command line and save the file.
   

  rem %JAVA% %JAVA_OPTS% -cp "%CLASS_PATH%" com.adventnet.mfw.Starter %SAFE_START% -c default -b <ip-address> to %JAVA% %JAVA_OPTS% -cp "%CLASS_PATH%" com.adventnet.mfw.Starter %SAFE_START% -c default -b <ip-address>   %JAVA% %JAVA_OPTS% -cp "%CLASS_PATH%" com.adventnet.mfw.Starter %SAFE_START% to rem %JAVA% %JAVA_OPTS% -cp "%CLASS_PATH%" com.adventnet.mfw.Starter %SAFE_START%

• Open setcommonenv.bat file which is under <EventLog Analyzer Home>bin directory and go to "JAVA_OPTS Setting command Block", uncomment the below JAVA_OPTS setting command line and replace <ip-address> with the IP address to which you want to bind the application and comment the existing JAVA_OPTS setting command.
   

  rem set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms128m -Xmx512m -Dspecific.bind.address=<ip-address> to set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms128m -Xmx512m -Dspecific.bind.address=<ip-address>   set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms256m -Xmx1024m to rem set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms256m -Xmx1024m

• Save the file
• Open the database_param.conf file which is under <EventLog Analyzer Home>conf directory and replace localhost in url tag with the <binding IP address> to which you want to bind the application and save the file.

• Open the postgresql.conf file which is under <EventLog Analyzer Home>pgsqldata directory and uncomment the line '#listen_addresses = 'localhost'' in the CONNECTIONS AND AUTHENTICATION section and replace the 'localhost' with the '<binding IP address>' to which you want to bind the application and save the file.
   

  #------------------------------------------------------------------------------ # CONNECTIONS AND AUTHENTICATION #------------------------------------------------------------------------------ # - Connection Settings - #listen_addresses = 'localhost' # what IP address(es) to listen on; # comma-separated list of addresses; # defaults to 'localhost'; use '*' for all # (change requires restart) to #------------------------------------------------------------------------------ # CONNECTIONS AND AUTHENTICATION #------------------------------------------------------------------------------ # - Connection Settings - listen_addresses = <binding IP address> # what IP address(es) to listen on; # comma-separated list of addresses; # defaults to 'localhost'; use '*' for all # (change requires restart)

• Open the pg_hba.conf file which is under <EventLog Analyzer Home>pgsqldata directory and add the line

host all all <binding IP address in IPv4 format>/32 trust

after the line

host all all 127.0.0.1/32 trust

and save the file.

• Restart EventLog Analyzer

For Eventlog Analyzer running as service:

• Stop the Eventlog Analyzer service.
• Open setcommonenv.bat file which is under <EventLog Analyzer Home>bin directory and go to "JAVA_OPTS Setting command Block", uncomment the below JAVA_OPTS setting command line and replace <ip-address> with the IP address to which you want to bind the application and comment the existing JAVA_OPTS setting command.
   

  rem set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms128m -Xmx512m -Dspecific.bind.address=<ip-address> to set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms128m -Xmx512m -Dspecific.bind.address=<ip-address>   set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms256m -Xmx1024m to rem set JAVA_OPTS=-Djava.library.path=..lib;..libnative -DpdfReport=false -Duser.country=US -Duser.language=en -DminDiskSpace=5 -Xms256m -Xmx1024m

• Save the file
• Open the wrapper.conf file which is under <EventLog Analyzer Home>server/conf and go to "Adding Application Parameters Block", uncomment the below Application Parameters from 2 to 5 and replace <ip-address> in 4th and 5th Application Parameter with the IP address to which you want to bind the application and save the file.

• Open the database_param.conf file which is under <EventLog Analyzer Home>conf directory and replace localhost in url tag with the <binding IP address> to which you want to bind the application and save the file.
   
• Open the postgresql.conf file which is under <EventLog Analyzer Home>pgsqldata directory and uncomment the line '#listen_addresses = 'localhost'' in the CONNECTIONS AND AUTHENTICATION section and replace the 'localhost' with the '<binding IP address>' to which you want to bind the application and save the file.
   

  #------------------------------------------------------------------------------ # CONNECTIONS AND AUTHENTICATION #------------------------------------------------------------------------------ # - Connection Settings - #listen_addresses = 'localhost' # what IP address(es) to listen on; # comma-separated list of addresses; # defaults to 'localhost'; use '*' for all # (change requires restart) to #------------------------------------------------------------------------------ # CONNECTIONS AND AUTHENTICATION #------------------------------------------------------------------------------ # - Connection Settings - listen_addresses = <binding IP address> # what IP address(es) to listen on; # comma-separated list of addresses; # defaults to 'localhost'; use '*' for all # (change requires restart)

• Open the pg_hba.conf file which is under <EventLog Analyzer Home>pgsqldata directory and add the line

host all all <binding IP address in IPv4 format>/32 trust

after the line

host all all 127.0.0.1/32 trust

and save the file.

• Start the EventLog Analyzer service
• Verify the setting by executing the 'netstat -ano' command in the command prompt.

For Build 8000 or earlier

To bind EventLog Analyzer server to a specific interface follow the procedure given below:
For Eventlog Analyzer running as application:

• Open the runSEC.exe/sh file.
• Add the following parameter in the line in any place before %* or $*: binSysEvtCol.exe -loglevel 3 -port 513 514 %*

-bindip <IP Address of the interface to which the EventLog Analyzer needs to be bound>
Example entry is as given below:
binSysEvtCol.exe -loglevel 3 -bindip 192.168.111.153 -port 513 514 %*
For Eventlog Analyzer running as service:

• Stop the Eventlog Analyzer service.
• Open the startDB.bat file which is under <Eventlog Analyzer Home>bin directory, add option '--bind-address=<ip-address>' in the mysqld start command that starts with @start and save the file.
• Open the stopDB.bat file which is under <Eventlog Analyzer Home>bin directory, add '-h <ip-address>>' to the command arguments and save the file.
  After the change the line should like the one given below: 
  set commandArgs=-P %PORT% -u %USER_NAME% -h <ip-address> 
• Open the wrapper.conf file which is under <Eventlog Analyzer Home>server/default/conf and follow the below steps: 
  Uncomment the second application parameter ' wrapper.app.parameter.2=-L../lib/AdventNetDeploymentSystem.jar'. 
  Add the following new application parameters 
  wrapper.app.parameter.3=-c default 
  wrapper.app.parameter.4=-b <ip-address> 
  wrapper.app.parameter.5=-Dspecific.bind.address=<ip-address> 
  and save the file.
  Note: Remove '#' symbol for uncommenting in the .conf file.

• Open the mysql-ds.xml file which is under <Eventlog Analyzer Home>server/default/deploy directory, replace 'localhost' inconnection-url tag with the <ip-address> to which you want to bind the application and save the file.
• Start the Eventlog Analyzer service.
• Verify the setting by executing the 'netstat -ano' command in the command prompt.

Startup and Shut Down

MySQL-related errors on Windows machines

Probable cause: An instance of MySQL is already running on this machine.
Solution:Shut down all instances of MySQL and then start the EventLog Analyzer server.

Probable cause: Port 33335 is not free
Solution: Kill the other application running on port 33335. If you cannot free this port, then change the MySQL port used in EventLog Analyzer.

EventLog Analyzer displays "Port 8400 needed by EventLog Analyzer is being used by another application. Please free the port and restart EventLog Analyzer" when trying to start the server

Probable cause: The default web server port used by EventLog Analyzer is not free.
Solution:

Kill the other application running on port 8400. Carry out the following steps.

• Stop the EventLog Analyzer service
• For Build 8010 onwards, open wrapper.conf which is available under <EventLog Analyzer Home>server/conf folder. For Build 8000 or earlier, open wrapper.conf which is available under <EventLog Analyzer Home>server/default/conf folder.
• Append the below line under # Java Additional Parameters section,

wrapper.java.additional.21=-Djava.net.preferIPv4Stack=true

Before adding:

wrapper.java.additional.20=-Dorg.tanukisoftware.wrapper.WrapperManager.mbean=false

After adding:

wrapper.java.additional.20=-Dorg.tanukisoftware.wrapper.WrapperManager.mbean=false
wrapper.java.additional.21=-Djava.net.preferIPv4Stack=true

• Start EventLog Analyzer service

If you cannot free this port, then change the web server port used in EventLog Analyzer.

EventLog Analyzer displays "Can't Bind to Port <Port Number>" when logging into the UI.

Probable cause:The syslog listener port of EventLog Analyzer is not free.
Solution:

• Check for the process that is occupying the syslog listener port, using netstat -anp -pudp . And if possible, try to free up this port.
• If you have started the server in UNIX machines, please ensure that you start the server as a root user.
• or, configure EventLog Analyzer to listen to a different syslog listener port and ensure that all your configured hosts send their syslog to the newly configured syslog listener port of EventLog Analyzer.

When the application is started, configureODBC.vbs throws script error or opens with another application. How to overcome this?

Probable cause: (File opens with other program) The configureODBC.vbs file may be set to open with a program other than "wscript.exe" in WINDOWSsystem32 folder (for example: Notepad.exe), hence the file was unable to execute during the application start.
Solution:

• Stop the Eventlog Analyzer server/service.
• Go to the Eventlog Analyzer installation folder <EventLog Analyzer Home>bin(default path) and right click the "configureODBC.vbs" file and choose Open (or) Open With and choose the windows program wscript.exe from your WindowsSystem32 folder.
• Start the Eventlog Analyzer server/service.

Probable cause: (File not having execute permission) The configureODBC.vbs file may not have execute permission.
Solution:

• Stop the Eventlog Analyzer server/service.
• Go to the Eventlog Analyzer installation folder <EventLog Analyzer Home>bin(default path) and right click the configureODBC.vbs file and change the permission to execute the file.
• Start the Eventlog Analyzer server/service.

Configuration

While adding host for monitoring, the 'Verify Login' action throws RPC server unavailable error

The probable reason and the remedial action is:
Probable cause: The host machine RPC (Remote Procedure Call) port is blocked by any other Firewall.
Solution: Unblock the RPC ports in the Firewall.

While adding host for monitoring, the 'Verify Login' action throws 'Access Denied' error. 

The probable reasons and the remedial actions are:

Probable cause: The host machine is not reachable from ELA machine.
Solution: Check the network connectivity between host machine and ELA machine, by using PING command.
Probable cause: The host machine running a System Firewall and REMOTEADMIN service is disabled.
Solution: Check whether System Firewall is running in the host. If System Firewall is running, execute the following command in the command prompt window of the host machine:
netsh firewall set service type=REMOTEADMIN mode=ENABLE profile=all

When WBEM test is carried out. it fails and shows error message with code 80041010 in Windows Server 2003.

The probable reasons and the remedial actions are:

Probable cause: By default, WMI component is not installed in Windows 2003 Server

Solution: Win32_Product class is not installed by default on Windows Server 2003. To add the class, follow the procedure given below:
 

1. In Add or Remove Programs, click Add/Remove Windows Components.

2. In the Windows Components Wizard, select Management and Monitoring Tools, then click Details.

3. In the Management and Monitoring Tools dialog box, select WMI Windows Installer Provider and then click OK.

4. Click Next.

How to enable Object Access logging in Linux OS?

The probable reasons and the remedial actions are:

Probable cause: The object access log is not enabled in Linux OS.

Solution: Steps to enable object access in Linux OS, is given below:

In the file /etc/xinted.d/wu-ftpd, edit the server arguments as mentioned below:

server_args = -i -o -L

What are commands to start and stop Syslog Deamon, in Solaris 10?

The probable reasons and the remedial actions are:

Probable cause: Unable to start or stop Syslog Daemon in Solaris 10

Solution: In Solaris 10, the commands to stop and start the syslogd daemon are:

# svcadm disable svc:/system/system-log:default

# svcadm enable svc:/system/system-log:default

In Solaris 10, to restart the syslogd daemon and force it to reread /etc/syslog.conf:

# svcadm refresh svc:/system/system-log:default
or
# svcadm -v restart svc:/system/system-log:default

Log Collection and Reporting

I've added a host, but EventLog Analyzer is not collecting event logs from it

Probable cause: The host machine is not reachable from the EventLog Analyzer server machine
Solution:Check if the host machine responds to a ping command. If it does not, then the machine is not reachable. The host machine has to be reachable from the EventLog Analyzer server in order to collect event logs.
Probable cause: You do not have administrative rights on the host machine
Solution: Edit the host's details, and enter the Administrator login credentials of the host machine. Click Verify Login to see if the login was successful.

I get an Access Denied error for a host when I click on "Verify Login" but I have given the correct login credentials

Probable cause: There may be other reasons for the Access Denied error.
Solution: Refer the Cause and Solution for the Error Code you got during Verify login.

I have added an Custom alert profile and enabled it. But the alert is not generated in EventLog Analyzer even though the event has occured in the host machine

Probable cause: The alert criteria have not been defined properly
Solution: Please ensure that the required fields in the Add Alert Profile screen have been given propelrly.Check if the e-mail address provided is correct. Ensure that the Mail server has been configured correctly.

When I create a Custom Report, I am not getting the report with the configured message in the Message Filter

Probable cause: The message filters have not been defined properly
Solution:When you are entering the string in the Message Filters for matching with the log message, ensure you copy/enter the exact string as shown in the Windows Event Viewer.
e.g., Logon Name:John

MS SQL server for EventLog Analyzer stopped

Probable cause: The transaction logs of MS SQL could be full
Solution: If the EventLog Analyzer MS SQL database transaction logs are full, shrink the same with the procedure given below:

• Stop the Eventlog Analyzer Server/Service (Check the Eventlog Analyzer server machine's Task Manager to ensure that the processes 'SysEvtCol.exe', 'Java.exe' are not running).
• Connect MS SQL client (using Microsoft SQL Server Management Studio) and execute the below query:
  sp_dboption 'eventlog', 'trunc. log on chkpt.', 'true'
  To execute the query, select and highlight the above command and press F5 key.
• After executing the above command, select and highlight the below command and press F5 key to execute it.
  DBCC SHRINKDATABASE (eventlog)
• Note: This process will take some time, based on the EventLog Analyzer database size.
• Start the Eventlog Analyzer.

I successfully configured Oracle host(s),still cannot view the data

If Oracle host is Windows, open Event viewer in that machine and check for Oracle source logs under Application type. If Linux, check the appropriate log file to which you are writing Oracle logs. If the Oracle logs are available in the specified file, still ELA is not collecting the logs, contact EventLog Analyzer Support.