Change reporting destination of event logs

Hi ,
I need to change destination of event logs. For example there is a event log xyz in application logs i want that log to report to system logs. Is it possible?
\m/

Simple answer - No.
Please read about how Event logs work. You will see that events are targeted by the application and you can only change that by changing the application. THe System log is owned by the system. You cannot change that.
¯\_(ツ)_/¯

Similar Messages

Vista got corrupt after power failure. sfc reports error and Event log service is unable to start itself.

Hi,
After a sudden power failure, I guess vista file system is corrupt.   I am able to start vista in normal mode, but it seems there are errors like Event Log service unable to start itself, when I start IE, it closes automatically ,
Norton antivirus does not start itself. and so on.
After Bing search, I went to safe mode and executed sfc /scannow and it reported error as below.
"Windows resource protection found corrupt files but was unable to fix some of them"
Unfortunately I am unable to upload log file, so I am pasting CBS.log content here....   Please advice.
Some parts of logs are removed due to limit of 60000 characters.
Please advice.
Regards
2014-07-07 14:55:57, Info                  CBS    Loaded Servicing Stack v6.0.6002.18005 with Core: C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.0.6002.18005_none_0b4ada54c46c45b0\cbscore.dll
2014-07-07 14:55:58, Info                  CSI
00000001@2014/7/7:09:25:58.062 WcpInitialize (wcp.dll version 0.0.0.5) called (stack @0x6e9c8a50 @0x7147854e @0x714563a1 @0x341392 @0x341ed4 @0x3417cb)
2014-07-07 14:55:58, Info                  CSI
00000002@2014/7/7:09:25:58.156 WcpInitialize (wcp.dll version 0.0.0.5) called (stack @0x6e9c8a50 @0x714ae7b6 @0x71490f93 @0x341392 @0x341ed4 @0x3417cb)
2014-07-07 14:55:58, Info                  CSI
00000003@2014/7/7:09:25:58.187 WcpInitialize (wcp.dll version 0.0.0.5) called (stack @0x6e9c8a50 @0x73981a0d @0x73981794 @0x34360b @0x342be3 @0x3417cb)
2014-07-07 14:55:58, Info                  CBS    NonStart: Checking to ensure startup processing was not required.
2014-07-07 14:55:58, Info                  CBS    NonStart: Windows is in Safe Mode.
2014-07-07 14:55:58, Info                  CSI    00000004 IAdvancedInstallerAwareStore_ResolvePendingTransactions (call 1) (flags = 00000004, progress = NULL,
phase = 0, pdwDisposition = @0x2dfe70
2014-07-07 14:55:58, Info                  CBS    NonStart: Success, startup processing not required as expected.
2014-07-07 14:55:58, Info                  CSI    00000005 CSI Store 4780952 (0x0048f398) initialized
2014-07-07 14:56:03, Info                  CSI    00000006 [SR] Verifying 100 (0x00000064) components
2014-07-07 14:56:03, Info                  CSI    00000007 [SR] Beginning Verify and Repair transaction
2014-07-07 14:56:10, Info                  CSI    00000008 Repair results created:
POQ 0 starts:
     0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\ca20037dc599cf01650000007806a403._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
    1: Move File: Source = [l:218{109}]"\SystemRoot\WinSxS\Temp\PendingRenames\aa070f7dc599cf01660000007806a403.program_files_ffd0cbfc813cc4f1.cdf-ms", Destination = [l:130{65}]"\SystemRoot\WinSxS\FileMaps\program_files_ffd0cbfc813cc4f1.cdf-ms"
    2: Move File: Source = [l:244{122}]"\SystemRoot\WinSxS\Temp\PendingRenames\6aca137dc599cf01670000007806a403.program_files_common_files_d7a65bb2f0e854e7.cdf-ms", Destination = [l:156{78}]"\SystemRoot\WinSxS\FileMaps\program_files_common_files_d7a65bb2f0e854e7.cdf-ms"
    3: Move File: Source = [l:278{139}]"\SystemRoot\WinSxS\Temp\PendingRenames\2a8d187dc599cf01680000007806a403.program_files_common_files_microsoft_shared_818c5a0e45020fba.cdf-ms", Destination = [l:190{95}]"\SystemRoot\WinSxS\FileMaps\program_files_common_files_microsoft_shared_818c5a0e45020fba.cdf-ms"
    4: Move File: Source = [l:286{143}]"\SystemRoot\WinSxS\Temp\PendingRenames\4ab11f7dc599cf01690000007806a403.program_files_common_files_microsoft_shared_ink_3c86e3db0b3b254c.cdf-ms", Destination = [l:198{99}]"\SystemRoot\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_3c86e3db0b3b254c.cdf-ms"
    5: Move File: Source = [l:292{146}]"\SystemRoot\WinSxS\Temp\PendingRenames\aa12227dc599cf016a0000007806a403.program_files_common_files_microsoft_shared_ink_en_7a951cedcb9a5105.cdf-ms", Destination = [l:204{102}]"\SystemRoot\WinSxS\FileMaps\program_files_common_files_microsoft_shared_ink_en_7a951cedcb9a5105.cdf-ms"
    6: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\aa28487dc599cf016b0000007806a403.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms"
    7: Move File: Source = [l:208{104}]"\SystemRoot\WinSxS\Temp\PendingRenames\6aeb4c7dc599cf016c0000007806a403.$$_ehome_40103e2da1d
2014-07-07 14:56:10, Info                  CSI    121de.cdf-ms", Destination = [l:120{60}]"\SystemRoot\WinSxS\FileMaps\$$_ehome_40103e2da1d121de.cdf-ms"
POQ 0 ends.
2014-07-07 14:56:10, Info                  CSI    00000009 [SR] Verify complete
2014-07-07 14:56:11, Info                  CSI    0000000a [SR] Verifying 100 (0x00000064) components
2014-07-07 14:56:11, Info                  CSI    0000000b [SR] Beginning Verify and Repair transaction
2014-07-07 14:56:19, Info                  CSI    0000000c Repair results created:
POQ 1 starts:
POQ 42 ends.
2014-07-07 14:58:29, Info                  CSI    000000b1 [SR] Verify complete
2014-07-07 14:58:30, Info                  CSI    000000b2 [SR] Verifying 100 (0x00000064) components
2014-07-07 14:58:30, Info                  CSI    000000b3 [SR] Beginning Verify and Repair transaction
2014-07-07 14:58:38, Info                  CSI    000000b4 Repair results created:
POQ 43 starts:
     0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\4a5ad3d4c599cf01391100007806a403._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
    1: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\4a5ad3d4c599cf013a1100007806a403.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms"
    2: Move File: Source = [l:234{117}]"\SystemRoot\WinSxS\Temp\PendingRenames\cadfdcd4c599cf013b1100007806a403.$$_help_windows_en-us_b594929e73669c5e.cdf-ms", Destination = [l:146{73}]"\SystemRoot\WinSxS\FileMaps\$$_help_windows_en-us_b594929e73669c5e.cdf-ms"
    3: Move File: Source = [l:228{114}]"\SystemRoot\WinSxS\Temp\PendingRenames\2a41dfd4c599cf013c1100007806a403.$$_help_help_en-us_91e6e7979a9bf9c6.cdf-ms", Destination = [l:140{70}]"\SystemRoot\WinSxS\FileMaps\$$_help_help_en-us_91e6e7979a9bf9c6.cdf-ms"
    4: Move File: Source = [l:214{107}]"\SystemRoot\WinSxS\Temp\PendingRenames\ea0ef7d4c599cf013d1100007806a403.$$_apppatch_1143992cbbbebcab.cdf-ms", Destination = [l:126{63}]"\SystemRoot\WinSxS\FileMaps\$$_apppatch_1143992cbbbebcab.cdf-ms"
    5: Move File: Source = [l:218{109}]"\SystemRoot\WinSxS\Temp\PendingRenames\ea241dd5c599cf013e1100007806a403.program_files_ffd0cbfc813cc4f1.cdf-ms", Destination = [l:130{65}]"\SystemRoot\WinSxS\FileMaps\program_files_ffd0cbfc813cc4f1.cdf-ms"
    6: Create Directory: Directory = [l:48{24}]"\??\C:\Program Files\MSN", Attributes = 00000080
POQ 43 ends.
2014-07-07 14:58:38, Info                  CSI    000000b5 [SR] Verify complete
2014-07-07 14:58:38, Info                  CSI    000000b6 [SR] Verifying 100 (0x00000064) components
2014-07-07 14:58:38, Info                  CSI    000000b7 [SR] Beginning Verify and Repair transaction
2014-07-07 14:58:43, Info                  CSI    000000b8 Repair results created:
POQ 44 starts:
     0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\eac6f0d7c599cf01a31100007806a403._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"
    1: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\aa89f5d7c599cf01a41100007806a403.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms"
    2: Move File: Source = [l:216{108}]"\SystemRoot\WinSxS\Temp\PendingRenames\6a4cfad7c599cf01a51100007806a403.$$_resources_fbee56ab048ab239.cdf-ms", Destination = [l:128{64}]"\SystemRoot\WinSxS\FileMaps\$$_resources_fbee56ab048ab239.cdf-ms"
    3: Move File: Source = [l:230{115}]"\SystemRoot\WinSxS\Temp\PendingRenames\caadfcd7c599cf01a61100007806a403.$$_resources_themes_4d0d4910e83c2273.cdf-ms", Destination = [l:142{71}]"\SystemRoot\WinSxS\FileMaps\$$_resources_themes_4d0d4910e83c2273.cdf-ms"
    4: Move File: Source = [l:240{120}]"\SystemRoot\WinSxS\Temp\PendingRenames\caadfcd7c599cf01a71100007806a403.$$_resources_themes_aero_3fd78bf4cb5fa2c4.cdf-ms", Destination = [l:152{76}]"\SystemRoot\WinSxS\FileMaps\$$_resources_themes_aero_3fd78bf4cb5fa2c4.cdf-ms"
    5: Move File: Source = [l:252{126}]"\SystemRoot\WinSxS\Temp\PendingRenames\8a7001d8c599cf01a81100007806a403.$$_resources_themes_aero_shell_a91dfa5124b343c4.cdf-ms", Destination = [l:164{82}]"\SystemRoot\WinSxS\FileMaps\$$_resources_themes_aero_shell_a91dfa5124b343c4.cdf-ms"
    6: Move File: Source = [l:276{138}]"\SystemRoot\WinSxS\Temp\PendingRenames\aa9408d8c599cf01a91100007806a403.$$_resources_themes_aero_shell_normalcolor_10be8ec981b35fb6.cdf-ms", Destination = [l:188{94}]"\SystemRoot\WinSxS\FileMaps\$$_resources_themes_aero_shell_normalcolor_10be8ec981b35fb6.cdf-ms"
    7: Move File: Source = [l:214{107}]"\SystemRoot\WinSxS\Temp\PendingRenames\cab80fd8c599cf01aa1100007806a403.$$_schcache_f995a5d4decb8cc0.cdf-ms", Destination = [l:126{63}]"\SystemRoot\WinSxS\FileMaps\$$_schcache_f995a5d4decb8cc0.cdf
2014-07-07 14:58:43, Info                  CSI    -ms"
    8: Move File: Source = [l:212{106}]"\SystemRoot\WinSxS\Temp\PendingRenames\cad948d8c599cf01ab1100007806a403.$$_msagent_be90584645cb9b95.cdf-ms", Destination = [l:124{62}]"\SystemRoot\WinSxS\FileMaps\$$_msagent_be90584645cb9b95.cdf-ms"
    9: Move File: Source = [l:214{107}]"\SystemRoot\WinSxS\Temp\PendingRenames\4a7578d8c599cf01ac1100007806a403.$$_system32_21f9a9c4a2f8b514.cdf-ms", Destination = [l:126{63}]"\SystemRoot\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms"
    10: Move File: Source = [l:242{121}]"\SystemRoot\WinSxS\Temp\PendingRenames\cafa81d8c599cf01ad1100007806a403.$$_system32_manifeststore_7d35b12f9be4c20e.cdf-ms", Destination = [l:154{77}]"\SystemRoot\WinSxS\FileMaps\$$_system32_manifeststore_7d35b12f9be4c20e.cdf-ms"
    11: Move File: Source = [l:224{112}]"\SystemRoot\WinSxS\Temp\PendingRenames\aae18dd8c599cf01ae1100007806a403.$$_msagent_chars_9a5bcb5da392f588.cdf-ms", Destination = [l:136{68}]"\SystemRoot\WinSxS\FileMaps\$$_msagent_chars_9a5bcb5da392f588.cdf-ms"
POQ 107 ends.
2014-07-07 15:08:01, Info                  CSI    00000213 [SR] Repair complete
2014-07-07 15:08:01, Info                  CSI    00000214 [SR] Committing transaction
2014-07-07 15:08:01, Info                  CSI    00000215 Creating NT transaction (seq 1), objectname [6]"(null)"
2014-07-07 15:08:01, Info                  CSI    00000216 Created NT transaction (seq 1) result 0x00000000, handle @0x4cc
2014-07-07 15:08:01, Info                  CSI
00000217@2014/7/7:09:38:01.060 CSI perf trace:
CSIPERF:TXCOMMIT;5
2014-07-07 15:08:01, Info                  CSI    00000218 [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction
have been successfully repaired
2014-07-07 15:15:58, Info                  CBS    Scavenge: Package store indicates there is no component to scavenge, skipping.

Hi,
First, I would suggest you using last known good configuration:
Using Last Known Good Configuration
http://windows.microsoft.com/en-in/windows/using-last-known-good-configuration#1TC=windows-vista
if this cannot bring your Windows Vista back to good state, I suggest you perform in-place upgrade to fix the corrupted files:
How to Perform an In-Place Upgrade on Windows Vista, Windows 7, Windows Server 2008 & Windows Server 2008 R2
http://support.microsoft.com/kb/2255099/en-us
If you have any feedback on our support, please click
here
Alex Zhao
TechNet Community Support

Crystal Reports Error in Event Log

Hi all,
I have an error in my events Logs on my Windows server 2003 Server. The Event ID is 4353 and the descirption is : "Either the keycode registry entry does not exist, or the process does not have sufficient permissions to read the keycode.'
I use CR XI.
Since I Have this error message I Can't load my reports.
Any ideas about this case?
Thanks in advance.
Xavier.

Thanks Graham but I don't have this key in the regitry.
In fact, I only use CrystalReports11_NET_EmbeddedInstall.msi to install Crystal Reports DLL.
Any ideas?
Thank you.
Xavier.

SSCM Reporting/Alerting Functions - Event Logs?

Good Evening:
I am trying to get some clarification on some functionality of SCCM in regards to alerting and what the client can do and or scrape on the client.
For example, I want to be able to generate an alert based on an event in the system logs of a client OS, if a particular log item has been generated. Should I be using queries to achieve this (if possible)? If so can someone guide me to some documentation.
Also I found some information on determining USB detection, which is great. I would like to use this as well, and generate these items via an email or report with subscription. Should I be using the asset intelligence for this piece?
Sorry for the vague questions, I really found no concrete information via 4 hours of google searching :(
Any help would be great.

For example, I want to be able to generate an alert based on an event in the system logs of a client OS, if a particular log item has been generated. Should I be using queries to achieve this (if possible)? If so can someone guide me to some
documentation.
This sounds more like an OpsMgr task.
USB detection? ConfigMgr can detect USB devices using hardware inventory, but that's about it.
Torsten Meringer | http://www.mssccmfaq.de

Reporting Services not automatically starting. System event log 7009, Application event: 18456

For the past month (since Oct 11,2012) reporting services (SSRS 2008R2) is not starting after the server is rebooted. The service is set to automatically start and starts manually without a problem. The system event log contains the following error:
Event ID 7009: A timeout was reached (30000 milliseconds) while waiting for the SQL Server Reporting Services (MSSQLSERVER) service to connect.
SQL logs :
The SQL logs has many "Event 18456 Login Failed, State 38" errors when the database engine starts. I assume clients conections are failing because the databases aren't online yet. None of these 18456 errors coorespond to the account reporting services
runs under.
The SQL logs indication Event 7009 occures before the "ReportingServer" database is online so im assuming there is a dependancy but I don't know how to avoid this.
This problem is occuring on a number of our servers running SSRS (if not all)
Any ideas?
Paul

Hi A141695,
For Event ID 7009, you can try to do the steps below to resolve it.
    1. Click Start, click Run, type regedit, and then click OK.
    2. Locate and then click the following registry subkey:
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
    3. Right-click Control, point to New, and then click DWORD Value.
    4. In the New Value #1 box, type ServicesPipeTimeout, and then press ENTER.
    5. Right-click ServicesPipeTimeout, and then click Modify.
    6. Click Decimal, type the number of milliseconds that you want to wait until the service times out, and then click OK.
For example, to wait 60 seconds before the service times out, type 60000.
Quit Registry Editor, and then restart the computer. For more information about it, please see:
http://www.sqlservercentral.com/Forums/Topic850540-1550-1.aspx#bm851211
http://myitforum.com/myitforumwp/2012/08/22/configmgr-2012-sms_srs_reporting_point-component-failure/
If you have any questions, please feel free to ask.
Regards,
Charlie Liao
TechNet Subscriber Support
If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback
here.

Audit/Log GPO changes and Logging of new addition of Domain Controllers in the Event Log

Hi all,
We am trying to log the following items in the event log for Windows 2012. This applies to a domain controller.
1) Audit any changes made to the Group Policy
2) Log the addition of new domain controllers added to the system.
We need the windows event log to record the above events for security purposes. Can anyone advise if this is doable? If yes what are the steps.
Thank you

Hi,
>>1) Audit any changes made to the Group Policy
We can enable audit for directory service object access and configure specific SACL for group policy files to do this.
Regarding how to step-to-step guide for auditing changes of group policy, the following two blogs can be referred to for more information.
Monitoring Group Policy Changes with Windows Auditing
http://blogs.msdn.com/b/ericfitz/archive/2005/08/04/447951.aspx
Auditing Group Policy changes
http://blogs.msdn.com/b/canberrapfe/archive/2012/05/02/auditing-group-policy-changes.aspx
>>2) Log the addition of new domain controllers added to the system.
Based on my knowledge, when a server is successfully promoted to be domain controller, event ID 29223 will be logged in the System log.
Regarding this point, the following thread can be referred to for more information.
Is an Event ID for a completed Domain Controller promotion logged on the PDC?
https://social.technet.microsoft.com/Forums/windowsserver/en-US/11b18816-7db0-49e2-9a65-3de0e7a9645e/is-an-event-id-for-a-completed-domain-controller-promotion-logged-on-the-pdc?forum=winserverDS
Best regards,
Frank Shen

"The event log file is full" error - SAP LVS Report Viewer 1.0

Hi Experts,
I'm getting an error when trying to generate a report in SAP LVS.
Error:
The event log file is full
How do I resolve this? Anyone encountered this error?
Thanks in advance,
Cyrous

Hi,
It seems that the audit log mechanism is activated, at your system. But, if you didn't set the parameter DIR_AUDIT, audit log will be created under "/usr/sap/<SID>/<instance>/log", not "data" folder. You can check its default value on RZ11. Revise the parameters, below;
DIR_AUDIT = <path>
FN_AUDIT = audit_++++++++.AUD
rsau/enable = 1
rsau/max_diskspace/local = <SizeOfFile>
Best regards,
Orkun Gedik

OpsMgr EventId 26007 on Domain Controllers "The EventLog service reported that the Security event log on computer ' ' is corrupt."

Hi,
We are receiving several eventids '26007' from the OpsMgr log on our Domain Controllers, also eventids '26008' with similar description are logged
The EventLog service reported that the Security event log on computer '<Domain Controller Computer>' is corrupt. The Windows Event Log Provider will attempt to recover by re-opening log.
I'll appreciate any suggestion in order to solve this issue.
Regards.

I guess this issue is caused by event ID 4661 is corrupted in security event log.
Please check if you have many 4661 events in security event log and XML view cannot be viewed.
Running the below command on DC will disable the auditing of the SAM Object access. This should stop the Event ID 4661 from being logged which should stop the Alert regarding corrupt Event log:
auditpol /set /subcategory:"SAM" /success:disable /failure:disable
Regards,

Event Log Question re: changing security timeout

I believe someone may have changed my security timeout time from 2 minutes to 30 minutes and changed "require password for new apps" from yes to no. I know the approximate time when this occured but am overwhelmed by the volume of entries and the nomenclature. Is there something specific I could look for to confirm or refute my suspicion? Is there a "layman's" way to download the log without having developer tools?
Thanks

Hey raindogbc,
You can extract the device logs as outlined in this article: How to extract the event logs on a BlackBerry smartphone http://btsc.webapps.blackberry.com/btsc/KB05349.
Depending on what the logging was set to when this happened and when it happened you may not be able to find this information.
-HB
Come follow your BlackBerry Technical Team on twitter! @BlackBerryHelp
Be sure to click Kudos! for those who have helped you.Click Solution? for posts that have solved your issue(s)!

Crystal Reports XI Crashes When Reporting on Event Log

I have successfully connected to the event log on my local Windows 7 pc, as well as two different Windows 2003 server event logs. The report runs fine unless I include the field "DESCRIPTION" on the report. If I include that field, CR crashes with the following error in my event log:
Faulting application name: crw32.exe, version: 11.0.0.1282, time stamp: 0x422d5c77
Faulting module name: crheapalloc.dll, version: 9.2.0.4, time stamp: 0x422d5ade
Exception code: 0xc0000005
Fault offset: 0x00002454
Faulting process id: 0x17e0
Faulting application start time: 0x01ca58e2b9115606
Faulting application path: C:\Program Files (x86)\Business Objects\Crystal Reports 11\crw32.exe
Faulting module path: C:\Program Files (x86)\Common Files\Business Objects\3.0\bin\crheapalloc.dll
Report Id: fe7f7599-c4d5-11de-a50a-001e4fe037ce
I've found a few sites online that others have had the same problem, but I've not found a solution. Any suggestions from anyone here??

Hi Carla, I moved this post to the database connectivity forum.
It may be due to the size or of the text included int he description or MS is reporting the wrong size of the field.
Other issue is XI is not supported on Windows 7 due to the age of CR and newness of Windows 7. CR XI is no longer patchable nor will any new OS platforms be added.
What you can do though is download CR XI R2 for free and use your XI keycode to install it, then go to the Keycode Request site and get one for R2:
Go to this link: http://www.sdn.sap.com/irj/boc and download the trial version of CR XI R2 and use your XI keycode, then apply the patches which you can get to by clicking on the BusinessObjects tab above, then Downloads.
Test again and if it still fails you may have to wait for Service Pack 6 to come out, I believe we are adding Windows 7 to the supported OS's.
Thank you
Don

Event Log Reporting Time Span

Having some connection problems, but can only see past one day in the Event Log. Get message "Limit of uservisible log" where in settings can I increase the report time to see past week or so, in Event Log ?

It sounds like you have a home hub 3 with the latest firmware?
You mean it looks like this - <<<<<<<<<<<<<<<<<<<< Limit of uservisible log >>>>>>>>>>>>>>>>>>>>
I get the same. The hub event log used to give 3 full pages of events, now the maximum I get is 2 full pages and 7 events logged on the 3rd page (uses around ¼ of the page).
You can't increase this, though if you have many events stored prior to the limit message, you could try switching the hub off to remove these older events or bite the bullet and factory reset the hub.
-+-No longer a forum member-+-

Webcache reports 'Connect failed errno = 146' in Event Log

Hi, when checking the webcache event log I keep getting the above message.
The webcache server and the application server are physically separate boxes on the same network. There is a firewall between them.
The webcache server runs purely webcache, the application server runs HTTP Server and OC4J. The connection from webcache to the application server is usually available but sometimes there is a timeout - which I'm assuming is related to the above.
I understand that a 146 error is a socket connection error.
Does anyone have any ideas on why I'm seeing this message and where I should start looking to sort it out ?
Thanks,
Paul.

You said "There is a firewall between them.".
That is probably the key issue here. Can you tell us what exactly is the firewall device. Is it transparent like some layer 3 or below device? With the given info, it is too wild to speculate what caused the connection failure. The problem is usually not in the application process running on the end system.

Event Log Help Links No Longer Working?

Have the help links in the Windows XP event log entries been discontinued?
They used to open up the Help and Support Center with further information about the Event Log error if it was available.
For some time now they have all just given a "page not found" error, which then re-directs to Bing with offered results that are no use at all!
This happens now on every XP system I've tried it on.
As a user of Windows 8.1 as well as XP, I'm well aware that the Windows 8 Event Log help links have never worked so far, but the XP ones always did, and despite the looming "End of Support" I can see no reason for all that information to have been
removed.
Any explanation for this?
Thanks, Dave Hawley.

Hi - thank you DaveHawley for the report. Just wanted to confirm that I've passed this on to the team that looks after the redirect service behind the "More Info" link.
There have been some major changes in how this redirection works over the years as well as in the last months. The most recent efforts added the option to enable use of the TechNet Wiki [sample]
to allow the community to comment & contribute for a given component. I'm only guessing here, but this might have accidentally impacted XP.
Thanks
Bruno

Home Hub 3. Constant connectivity loss. Event log ...

Trying to get any kind of service out of my BT Infinity provision nowadays is like trying to arrange a tsunami in a desert.
Time after time after time after time, the Internet is working normally but then a page refuses to refresh and attempts to open another website result only in 'page not found' even though the Internet-connection icon is glowing steadily in the tray, and when I ask Windows to check on things, it reports that no problems have been found and the connection is working normally.
Except, of course, it isn't. I am not a technical expert and therefore haven't much of a clue where to start with this. My Vista OS runs with Panda Cloud AV and Malwarebytes PRO and Windows Firewall, all three of which have always played nicely. Prior to switching to BT Infinity, I had 'ordinary' BT broadband via a Netgear wireless router. The service was trouble-free.
This morning, I decided to delve into BT Home Hub Manager to re-set to factory default. That in itself took some doing because clicking on the Firefox bookmark got me nowhere at all: I had to sit here and wait for 10 minutes before the Hub page suddenly appeared as if out of nowhere.
I found in the event logs a seemingly unending chain of firewall related reports. Rather than read 'em all, I just hit re-set and whoa-hey, after a 5 or 6 minute wait, everything was fine and dandy again. . .
Until, 20 minutes later, it wasn't. Despite the re-set, Internet connectivity was shot to pieces. I'm on Amazon UK and click to open a new page in a new tab: Page Not Found. On the BBC News website, click on a link to open in a new tab: Page Not Found. Reload any of those exisdting, open pages and the reload circle just spins and spins until. . . Page Not Found.
Unfortunately, I can't make head nor tail of the log reports in the Firewall section, but typically they read:
IN: BLOCK [16] Remote administration
BLOCKED 1 more packet [because of Remote Administration]
IN: BLOCK [9] Packet invalid in connection
BLOCKED 4 more packets (because of Packet invalid in connection)
IN: BLOCK [9] Packet invalid in connection
BLOCKED 20 more packets (because of Packet invalid in connection)
BLOCKED 40 more packets (becuase of Packet invalid in connection)
And so it goes on. . . and on. It's not even clear to me if the Home Hub is doing the blocking anyway, but if it is, then I can't begin to figure out why websites like Amazon UK, BBC News, Speedtest and even Google Maps should be BLOCKED.
Help appreciated. . . always assuming, this post actually gets through -- I've no idea if this page has gone down or not, because though it's on-screen, that no longer means anything at all.

Thanks, Ray. Just managed to get back on here, there's been virtually no connectivity at all. One odd thing has been that the Home Hub Manager has opened OK. But it is no longer in agreement with the computer about whether or not connectivity exists. For example:
1) Click on disconnect in HH Manager, and it reports that the task has been achieved and the button changes to 'connect'.
But no disconnection has occurred. The Internet icon is still in the tray in its 'connected' state. And it's possible to go on the Net and briefly open up a website that isn't in the FF cache. But then everything fails again. Alternatively:
2) Click 'disconnect' in the tray control and the icon changes shows a bid red x. But the HH Manager doesn't agree. It continues to report that the computer is connected to the Internet.
I'm baffled and wearied. I'll have to relocate the Infinity set-up from downstairs to where this computer is; I'm assuming, I leave the modem in place (the new white flat thing the engineer brought when he installed Infinity)and just disconnect the black HH3 and brin g it upstairs and plug it into the PC?
Thanks for your help, much appreciated.

SCOM 2012 R2 Exchange Correlation Service , we receive almost at every day in the Event log Application the Event720

HI
Since the SCOM was Upgrade to R2
Almost at every Day, we receive in the Event log application the Event 720 from the correlation service Source MSExchangeMonitoring Correlation
This arrives always around 7:20AM, someday is at 7:19, other at 7:21. It is always approximately at the same hour, but we never have any problem during weekend
The description of the Event
Exceeded maximum time (15 minutes) to wait for completion of all CorrelateBatchTask threads.
After that the correlation stop to work. At the Same time if we tried to open the SCOM Console on that server we was unable to open it. Also we was not able to open the SCOM PowerShell
And also we cannot from that server to get which server is the RMS if we run get-SCOMRMSEmulator . (This the RMS Server)
When this arrive, the only thing we found, it to reboot the server or restart de SCOM service, after the Reboot the Correlation begin to work
We got also many Event 714 Critical and after this Event 711 Warning
Thank

Have a look at: https://social.technet.microsoft.com/Forums/systemcenter/en-US/e75e84d9-0c9e-4d83-b3da-45a143757f85/exchange-2010-monitoring-with-scom-2012-correlation-service-issue
One user reported an issue with the exchange correlation engine after upgrade and said that:
I had issues with the corellation engine after upgrading scom 2012 to R2.
The MomBidLdr.dll version changed in the SCOM directories, and needs to be updated in the:
C:\Program Files\Microsoft\Exchange Server\v14\Bin directory.
That seemed to stop the errors for me.
Some troubleshooting steps listed here also:
https://technet.microsoft.com/en-us/library/ff360495(v=exchg.140).aspx
Cheers,
Martin
Blog:
http://sustaslog.wordpress.com
LinkedIn:
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

Change reporting destination of event logs

Similar Messages

Maybe you are looking for