Event Forwarding Subscription Parameters

Hello,
You provided a good installation guide to create a source initiated subscription here: http://msdn.microsoft.com/en-us/library/windows/desktop/bb870973%28v=vs.85%29.aspx
However, I'd like to know how it really works. Here are a few questions:
Are the logs pulled or pushed? Is this dependent on the Subscription weather it is Normal Mode or Minimize Bandwidth/Latency ? If so, how does the source computer know to push the logs or wait until pulled?
The XML file of a Subscription is very complex. Here is one from the msdn:
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
<SubscriptionId>SampleSISubscription</SubscriptionId>
<SubscriptionType>SourceInitiated</SubscriptionType>
<Description>Source Initiated Subscription Sample</Description>
<Enabled>true</Enabled>
<Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>

<ConfigurationMode>Custom</ConfigurationMode>
<Delivery Mode="Push">
<Batching>
<MaxItems>1</MaxItems>
<MaxLatencyTime>1000</MaxLatencyTime>
</Batching>
<PushSettings>
<Heartbeat Interval="60000"/>
</PushSettings>
</Delivery>
<Expires>2018-01-01T00:00:00.000Z</Expires>
<Query>
<![CDATA[
<QueryList>
<Query Path="Application">
<Select>Event[System/EventID='999']</Select>
</Query>
</QueryList>
]]>
</Query>
<ReadExistingEvents>true</ReadExistingEvents>
<TransportName>http</TransportName>
<ContentFormat>RenderedText</ContentFormat>
<Locale Language="en-US"/>
<LogFile>ForwardedEvents</LogFile>
<AllowedSourceNonDomainComputers></AllowedSourceNonDomainComputers>
<AllowedSourceDomainComputers>O:NSG:NSD:(A;;GA;;;DC)(A;;GA;;;NS)</AllowedSourceDomainComputers>
</Subscription>
What is meant by HeartbeatInterval and Max Latency Time?
Next: When configuring the source computer i have to configure a Refresh time in the Policy key. (Computer Settings - Policies - Administrative Templates - Windows Components - Event Forwarding).
What is meant by that? when is this value being used for what?
If I do not specify this refresh param, what is the default value?
I really hope someone here can help me out of my confusion.
Every Advice is appreciated

Hi,
Thanks for your post.
>>What is meant by HeartbeatInterval and Max Latency Time?
Heartbeat Interval determines how often collector will check if source is still online,
MaxItems and MaxLatencyTime determine how source will batch items. In this example it will wait for 1 events or 1 seconds
<MaxItems>1</MaxItems>
<MaxLatencyTime>1000</MaxLatencyTime>
>>Next: When configuring the source computer i have to configure a Refresh time in the Policy key. (Computer Settings - Policies - Administrative Templates - Windows Components - Event Forwarding)
If you enable this policy setting, you can configure the Source Computer to contact a specific FQDN (Fully Qualified Domain Name) or IP Address and request subscription specifics.
If you disable or do not configure this policy setting, the Event Collector computer will not be specified.
>>when is this value being used for what? If I do not specify this refresh param, what is the default value?
In my view, it is connection refresh time, we must set this parameter, for example,
Use the following syntax when using the HTTPS protocol:
Server=https://<FQDN of the collector>:5986/wsman/SubscriptionManager/WEC,Refresh=<Refresh interval in seconds>,IssuerCA=<Thumb print of the client authentication certificate>
Meanwhile, i think you may ask in MSDN forums for technical support.
https://social.msdn.microsoft.com/Forums/en-US/home
Regards.
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Similar Messages

Windows 7 - Event Log Subscription

I have setup a windows 7 system to be the event log subscription collector. I have all my servers sending the application, security and system logs to the collector and all is working OK.
How can I set this up so it can collect DHCP, DNS, DFS, Active Directory, etc logs to be forwarded to the collections server as it is not an entry on my windows 7 system that I can pick from.

Hi,
Please create a new Subscription, this would give you a chance to Select Events:
Create a New Subscription
http://technet.microsoft.com/en-us/library/cc722010.aspx
If you have any feedback on our support, please click
here
Alex Zhao
TechNet Community Support

Windows Event forwarding - What is a "Valid destination log"

Hi all,
I'm currently setting up a centralization infrastructure for Windows events using the built-in event forwarding capabilities available in Windows Server 2008 R2.
One of my requirements is to be able to create several subscriptions on the collector machine and to store forwarded events in different log files. For that, I tested creating a custom log (called CustomLog). This log appears in the Event Viewer, under the
"Applications and Services Logs".
However, I am not able to redirect forwarded events to this CustomLog. CustomLog does not appear in the list of possible destination in the Event Viewer GUI to create a subscription.
To try what could be wrong, I left it with the default ForwardedEvents as destination and I tried to change it via Powershell. I ran the following command supposed to set the destination log as CustomLog:
wecutil ss "Collect from both sources" /lf:CustomLog
It ran without error. Though, no events were logged into CustomLog, and when I go back to the GUI to create/modify subscriptions and I try to open the subscription I set, I get a pop-up stating the following:
"The destination log defined in this subscription cannot be found in the list of valid destination logs on this computer. verify that this log exists on the computer and is valid as a destination for forwarded events. Note that classic logs, analytic
and debug logs and the Security log cannot be used as destination."
Does anybody know what a "valid destination log" is and how I could turn my CustomLog into such a valid destination?
Kind regards,
Mike
P.S. How can I verify my account in order to be able to post screenshots?

MikeSec, did you ever get an answer to this? I'm facing the same and wondered how to setup a custom log location for event forwarding also. Getting the same error as you "The destination log defined in this subscription cannot be found in the list of
valid destination logs on this computer. Verify that this log exists on the computer and is valid as a destination for forwarded events. Note that classic logs, analytic and debug logs and the Security log cannot be used as destinations."
Seems that there isn't a way to register new event-logs as valid destinations or channels for event-forwarding.

JTree and real Components / event forwarding

Ok, so Ive seen some people forward events from JTree to node based Components.
I was just wondering, whether thats the right way to go.
Wouldn't it be better to write your own TreeLayoutManager, add the node based components with nodes as constraints to the the manager and add or remove them when the tree expands/collapses.
My only problem is, when to trigger the doLayout and how to get the proper node sizes. The only given value is the available width in the cellrenderer.
The cellrenderer would just return an empty, properly sized JLabel, and the "layoutmanager" would take care of the the real positioning.
That way I could have the painting speed benefits of a Jtree, combined with the flexibility of real components stored as nodes in it, right?
Well, I'm just looking for opinions on this.
Shoot :-D

Hi,
Thanks for your post.
>>What is meant by HeartbeatInterval and Max Latency Time?
Heartbeat Interval determines how often collector will check if source is still online,
MaxItems and MaxLatencyTime determine how source will batch items. In this example it will wait for 1 events or 1 seconds
<MaxItems>1</MaxItems>
<MaxLatencyTime>1000</MaxLatencyTime>
>>Next: When configuring the source computer i have to configure a Refresh time in the Policy key. (Computer Settings - Policies - Administrative Templates - Windows Components - Event Forwarding)
If you enable this policy setting, you can configure the Source Computer to contact a specific FQDN (Fully Qualified Domain Name) or IP Address and request subscription specifics.
If you disable or do not configure this policy setting, the Event Collector computer will not be specified.
>>when is this value being used for what? If I do not specify this refresh param, what is the default value?
In my view, it is connection refresh time, we must set this parameter, for example,
Use the following syntax when using the HTTPS protocol:
Server=https://<FQDN of the collector>:5986/wsman/SubscriptionManager/WEC,Refresh=<Refresh interval in seconds>,IssuerCA=<Thumb print of the client authentication certificate>
Meanwhile, i think you may ask in MSDN forums for technical support.
https://social.msdn.microsoft.com/Forums/en-US/home
Regards.
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Event viewer subscriptions error code 0x32

I’m using windows 7 home premium trying to configure event viewer subscriptions.
But getting error code (0x32) .
[hadi-TOSH] -
Error - Last retry time: 4/9/2014 6:28:35 PM. Code (0x32): <f:ProviderFault provider="Event Forwarding Plugin" path="%systemroot%\system32\wevtfwd.dll" xmlns:f="http://schemas.microsoft.com/wbem/wsman/1/wsmanfault"><t:ProviderError
xmlns:t="http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog">Windows Event Forward Plugin failed to create subscription.</t:ProviderError></f:ProviderFault>
Next retry time: 4/9/2014 7:08:35 PM.

Hi,
Please make sure the Windows Event Collector service is started. You must be a member of the Administrators group to start this service.
http://technet.microsoft.com/en-us/library/cc748890.aspx
Kate Li
TechNet Community Support

Event subscriptions and Event Group subscriptions

Hi,
I have a set of events with subscriptions to each one of them.
Assume I create a Event group with all the events as a member in it.
I also create a subscription for the event group while the individual event subscriptions are still existing.
Will the subscription for the group be executed first or the individual subscriptions are executed first ?
Regards,
Srini.

Hi, a few more additional observations.
My subscription(S1) to the event group launches a process (P1) defined in a workflow item type(BEVLIS).
My subscription(S2) to the individual event launches another process (P2) defined in the same workflow item type BEVLIS.
Now when i raised an event... oracle.apps.per.api.person.update_person with event key 1820 following happens..
1. S1 executed and the P1 got completed successfully. The item key observed in staus monitor is *1820*
2. But on execution of S2 I got the following error notified
Event Error Name: WFENG_EVENT_NOTFOUND
Event Error Message: 3142: Process 'BEVLIS/1820' has no activities waiting to receive event 'oracle.apps.per.api.person.update_person'.
Event Error Stack:
Wf_Engine.Event(BEVLIS, 1820, NOTIFY_QUERY_RESULT2, oracle.apps.per.api.person.update_person)
So prior to execution of S2, a workflow item type BEVLIS with item type 1820 was already available and marked as completed.
And hence the S2 execution looks for a waiting activity in a process which is already competed and hence fails.
An immediate soln will be to create another item type and copy the process P2 to it. and use it for S2.
But is this the behavior expected in subscription processing?
~srini

Event Handler with parameters

I am to create a generic event handler ro process XML
returned from the server. Its name is this code is "loadFormData".
Here is my code:
var params:Object = new Object();
params.requesttype = 'send';
params.datarequest = 'xml';
params.methodexecute = 'mProcessFileRequest';
params.formname = "FileIdAction";
params.fileid = parentApplication.cboFileList.id;
var t:loadFileData = new loadFileData();
xmlModuleData.addEventListener(ResultEvent.RESULT,
t.loadFormData(ResultEvent, frmGeneral));
var r:runXML = new runXML();
r.getXMLData(xmlModuleData, params);
It would work if I dont send any parameters to
t.loadFormData. But then it is not a generic solution. Is it
possible to send parameters to a callback function?
Thanks

Thanks Charlie
Liao
and congrats to all :-)
* Charlie,
is there a new "Auto Spam Filter"?
[Personal Site] [Blog] [Facebook]

Another JTable/buttons in cells query - event forwarding

Hi Everyone.
Apologies in advance for yet another thread on this subject. I realise this has been discussed a number of times but I can't find what seems like a definitive solution.
I understand what the fundamental issue is with putting JComponents in table cells - i.e. that the cells are rendered essentially as static visual entities, that they're not "components" as such and will not receive events.
I'd like to implement JButtons in table cells so that they behave as "normally" as possible - i.e. handle their own roll-over appearance, handle their own pressed appearance, and fire action events when pressed, with as little manual intervention in these mechanisms (e.g. in mouse listener code) as possible. I'm trying to do this by forwarding mouse events from the table to the button, but this doesn't seem to work as I'd hoped and I have various questions...
(Background: I have implemented JButton objects in the data model, and the getTableCellRendererComponent() method returns *(JButton)value*.)
My first question concerns the interception of mouse events. The usual technique would be to add a mouse listener and/or mouse motion listener to the table, and implement mouseClicked(), mousePressed() etc. However, can I override the table's processMouseEvent() and processMouseMotionEvent() methods instead, and from here forward events to buttons where appropriate, or process normally with super.processMouseEvent()? My motivation for doing this would be specifically not to invoke the super methods where events were forwarded to buttons - effectively consuming the event. Is this correct technique?
My second question concerns attempts to reproduce button roll-over appearances. The JTable is of course considered a single entity as far as mouse events are concerned, and MOUSE_ENTERED and MOUSE_EXITED events aren't generated as the pointer moves from cell to cell. Merely forwarding mouse events to buttons - which will mostly be MOUSE_MOVED events - seems to be insufficient and presumably the roll-over appearance change relies upon ENTERED and EXITED events occurring at the proper times.
I mimicked this behaviour in my override of processMouseMotionEvent() by calculating the value (i.e. JButton reference) of the cell under the mouse pointer, and if it wasn't the same as for the previous event, manually creating a MOUSE_ENTERED event and forwarding it to the new button. This seemed to work - the rollovers were happening (provided a table repaint() was performed), but it seemed to work without needing to explicitly sending a MOUSE_EXITED to the previous button before sending MOUSE_ENTERED to the new. I'm unclear why this is so - I was half-expecting both buttons to acquire the roll-over state, and they didn't.
Also, I had assumed that having taken care of this, I should forward MOUSE_MOVED events occurring within the confines of a cell's area to the button verbatim, but this seems to instantly cancel out any roll-over (visually the button would briefly flash a roll-over appearance as the pointer moved into its cell bounds). Why might this be so?
My last question is about the actual pressing of the button. I had hoped that forwarding MOUSE_CLICKED, MOUSE_PRESSED and MOUSE_RELEASED would cause the button to (a) acquire the button-pressed state, and (b) fire an action event to its action listeners. Neither of these things occur, and I don't understand why not.
In summary, is interception and forwarding of events like this a viable technique for implementing table cell buttons? The various solutions that a Google trawl throws up all reproduce button-pressing mechanics in varying degrees, some just detecting a click and calling some user function, others manually manipulating the button model in the mouse handler etc. If possible I'd like to avoid this, and leave as much processing as possible to the button's native code.
Thanks in advance for any suggestions received.
Regards,
A.

try to look on this
http://java.sun.com/docs/books/tutorial/uiswing/components/table.html#editrender

Can any bady send the WDJ application on event handler & plug parameters?

Hi,
Experts,
I have no idea no WDJ Event handler and plug parameters usage if any bady can send me few WDJ application or scenarios which is based on event handler parameters and plug parameters and method parameters.
Thans in advance,
Shaber Ahmed.

Hi
Use this pdf(Example) for event handler
http://www.sappro.com/downloads/WebDynproJava.pdf
for plug parameters usage
https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/91b6ad90-0201-0010-efa3-9626d2685b6e?overridelayout=true
Thanks

Building Contextual Events with multiple parameters

I am working in JDeveloper 11.1.1.4 and trying to build a contextual event, but ran into a issue that I find unclear. When building the Subscribers on my page definition, in the Property Inspector, how do I define multiple parameters in the customPayLoad element? In all the examples I've found, they reference putting ${payLoad} as the value and they only show one parameter. I need each value to be unique for each parameter. How do I accomplish this?

for this you can use attributes
say suppose if you are using table then you can pass values from producer like
            Map attributes = table.getAttributes();
            attributes.put("param1", param1);
            attributes.put("param2", param2);
            attributes.put("param3", param3);
            attributes.put("param4", param4);and consume it like
    public void handleBusinessChkListEvent(Object payload) {
        SelectionEvent selectionEvent = (SelectionEvent)payload;
        UIComponent component = (UIComponent)selectionEvent.getSource();
        String param1=
            (String)component.getAttributes().get("param1");
        String param2= (String)component.getAttributes().get("param2");
        Boolean param3=
            (Boolean)component.getAttributes().get("param3");
        String param4=
            (String)component.getAttributes().get("param4");
}

PO workflow process raises event but subscription does not fire

Hi:
We are sending POs electronically in XML (11.5.10.2). The PO reaches the supplier correctly. The workflow process to send the PO to the supplier completes successfully. The workflow diagrammer shows that the process fully completes. The last task in the standard process raises an event called oracle.apps.po.event.xmlposent. By default this event has no subscriptions, but I created a subscription that will call a custom workflow process. In testing, I can manually raise this event, and my custom process works. But when the full process runs and completes my custom process does not run. Again, according to the workflow diagrammer, the event in question gets raised. I find no evidence of the event in question in an queue. Why would the process complete, including the step to raise the event in question, but I find no trace of it.
Can anyone suggest additional debugging steps or a solution?
Thank you!

Hi,
I have answered your duplicate post on the [WorkflowFAQ forum|http://smforum.workflowfaq.com/index.php?topic=1045.0].
Matt
WorkflowFAQ.com - the ONLY independent resource for Oracle Workflow development
Alpha review chapters from my book "Developing With Oracle Workflow" are available via my website http://www.workflowfaq.com
Have you read the blog at http://www.workflowfaq.com/blog ?
WorkflowFAQ support forum: http://forum.workflowfaq.com

Using a Foreign JMS Destination as a JMS Event Generator Subscription

NOTE THIS IS BUMPED UP FROM ROBERT NORTON'S POST. I am having the same
problem here. From the wliconsole, the only queues listed to have events
generated from are local ones.
Hello,
I'm trying to create a workflow that is started by a JMS message queue
event.
I'm trying to use the WLIJMSEventGenTool in WebLogic 8.1 to listen to a
queue
on a remote WebLogic 8.1 installation, publish the incoming messages to
a channel,
then initiate a workflow by subscribing to that channel. Here's a copy
of my configuration
file for the tool:
<message-broker-jms-event-generator-def
source-jndi-name="SearchInputQueue"> <channel
name="/srm/sInput/sInput" /> </message-broker-jms-event-generator-def >
I tried to tackle this by configuring a foreign JMS Server, Connection
Factory,
and Destination using the Weblogic Admin Console. Below are the
parameters I used
to define the remote connection
Foreign JMS Server:
jndi initial context factory: weblogic.jndi.WLInitialContextFactory jndi
connection
url: //OPER1090:7001
Foreign connection factory:
local jndi name: FtsFactory remote jndi name:
weblogic.jws.jms.QueueConnectionFactory
(Are username and password required?)
Foreign JMS Destination:
local jndi name: SearchInputQueue remote jndi name:
InternalSearchInputQueue
After I try to deploy my generated JMS Event jar, I receive the
following error:
<Jun 6, 2003 10:31:50 AM EDT> <Warning> <EJB> <BEA-010061> <The
Message-Driven
E JB: SearchInputQueue-UnorderedMessageListener is unable to connect to
the JMS
de stination: SearchInputQueue. The Error was: [EJB:011010]The JMS
destination
with the JNDI name: SearchInputQueue could not b e found. Please ensure
that the
JNDI name in the weblogic-ejb-jar.xml is correct , and the JMS
destination has
been deployed.>
I'm pretty sure the problem is simply that my syntax is off somewhere in
my configuration.
I found the existing BEA documentation to be a bit too generic,
containing no
specific examples of the proper syntax to use for this task. Can anyone
offer
any advice or better, a working example? Any BEA reps out there?

NOTE THIS IS BUMPED UP FROM ROBERT NORTON'S POST. I am having the same
problem here. From the wliconsole, the only queues listed to have events
generated from are local ones.
Hello,
I'm trying to create a workflow that is started by a JMS message queue
event.
I'm trying to use the WLIJMSEventGenTool in WebLogic 8.1 to listen to a
queue
on a remote WebLogic 8.1 installation, publish the incoming messages to
a channel,
then initiate a workflow by subscribing to that channel. Here's a copy
of my configuration
file for the tool:
<message-broker-jms-event-generator-def
source-jndi-name="SearchInputQueue"> <channel
name="/srm/sInput/sInput" /> </message-broker-jms-event-generator-def >
I tried to tackle this by configuring a foreign JMS Server, Connection
Factory,
and Destination using the Weblogic Admin Console. Below are the
parameters I used
to define the remote connection
Foreign JMS Server:
jndi initial context factory: weblogic.jndi.WLInitialContextFactory jndi
connection
url: //OPER1090:7001
Foreign connection factory:
local jndi name: FtsFactory remote jndi name:
weblogic.jws.jms.QueueConnectionFactory
(Are username and password required?)
Foreign JMS Destination:
local jndi name: SearchInputQueue remote jndi name:
InternalSearchInputQueue
After I try to deploy my generated JMS Event jar, I receive the
following error:
<Jun 6, 2003 10:31:50 AM EDT> <Warning> <EJB> <BEA-010061> <The
Message-Driven
E JB: SearchInputQueue-UnorderedMessageListener is unable to connect to
the JMS
de stination: SearchInputQueue. The Error was: [EJB:011010]The JMS
destination
with the JNDI name: SearchInputQueue could not b e found. Please ensure
that the
JNDI name in the weblogic-ejb-jar.xml is correct , and the JMS
destination has
been deployed.>
I'm pretty sure the problem is simply that my syntax is off somewhere in
my configuration.
I found the existing BEA documentation to be a bit too generic,
containing no
specific examples of the proper syntax to use for this task. Can anyone
offer
any advice or better, a working example? Any BEA reps out there?

Whatis business event system,subscription-based processin in oracle workflo

can you please highlight on business event system and subscription based processing in oracle workflow
i web searched it too but am still confused
need to clear my mis conceptions
thanks

hello hussein
I have gone through some material already from oracle website but somehow am still confused
can you shortly highlight the difference between them if possible
thanks
Muhammed

SQL Server event forwarding error (can't find solution via bing or google)

I'm setting up a new central DBA server for Central Management Server, Performance DW and alerts.
Older SQL 2000 and 2005 can forward their alerts with no problem. But newer servers on SQL 2008 R2 and SQL Server 2012, get the following errors:
SQL 2008 R2: [LOG] Unable to open the eventlog on forwarding server '<server name>' (reason: 5)
SQL 2012: [LOG] Unable to open the eventlog on forwarding server '<server name>' (reason: Access is denied)
/Kenn

Hi Kenn,
Based on the error message, this issue can occur if SQL Server 2008 or SQL Server 2012 service account doesn’t have permission to access the log file, please refer to the detail steps on the following documents to configure file system permissions for database
engine access.
Configure File System Permissions for Database Engine Access
http://technet.microsoft.com/en-us/library/jj219062.aspx
Best Regards,
Allen Li
Allen Li
TechNet Community Support

To create event log server

Hi,
I want to create a event log server at my data center, I mean, I want to collect the event logs from all my servers and manage the logs centrally, please guide me the steps for this.
Swaprakash..

Hi,
I want to create a event log server at my data center, I mean, I want to collect the event logs from all my servers and manage the logs centrally, please guide me the steps for this.
Swaprakash..
If your Enterprise uses SCOM for monitoring, you can easily
configure and deploy Audit Collection Reporting (ACS) to pull events from servers based on specific criteria.
You can also manually configure event forwarding/subscriptions. Here's a
link on how.
Only when the above two options are impossible will I start to look at a scripting solution, using
Get-Eventlog or
Get-WinEvent cmdlets.

Event Forwarding Subscription Parameters

Similar Messages

Maybe you are looking for