Cisco IDSM Event Viewer - Understanding Event ID

Hi Everyone
Attached in this discussion is a screen shot of the Event Viewer. Just to inquire, I see a lof of these message e.g. TIPC: Lost contact with, TIPC: Lost link etc.
Is this a problem? These error messages comes with Event ID, but I'm unable to find the meaning of the Event ID. Can someone advice me please.
Thank you
Regards,
Ram

TIPC messages are communications between the IPS module and the main Chassis. Looks like there are some issues in the communication which may go away after you reset the device. As for the eventID, any event or alert that is generated on the sensor will be assigned a unique ID. This is called the eventID and is used to correlate the summary alerts vs First alerts, Log events to alert events, etc.
Hope this helps
Madhu

Similar Messages

Event Viewer Error - event id 51 windows 2012 r2

Does anyone know this one? We are getting a repeated error on this 51.
Any way to resolve it?
An error was detected on device \Device\Harddisk1\DR1 during a paging operation.
Level: warning
Log Name: system
This topic first appeared in the Spiceworks Community

Hi,
I/O device error can generate while reading or writing from a drive, disk, or portable media device.
To troubleshoot such error, please refer to
http://www.tech-faq.com/io-device-error.html
NOTE This response contains a reference to a third
party World Wide Web site. Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites.
Andy Altmann
TechNet Community Support

Programmatically change Event Viewer properties in C#

Hi there,
First of all, I am not sure if this is the right forum for this post (my guess is not). Someone please let me know what the right forums is if you see this is not and I will try to move it. thx.
IIS 7.5 supports IIS configuration auditing by setting a Event Viewer property:
Event Viewer/Applications and
Services Logs/Microsoft/Windows/Operational/Enable Log.
I tried it through Event Viewer and it worked great. But what I need is not to do that manually using Event Viewer.
Instead, I need to achieve that programmatically in C# through API - an API for programmatically setting the above Event Viewer property (not IIS property) so that I can enable the logging .
Is that possible?
If so, how?
Any help is highly appreciated.
Feng

Hi Feng,
If you don’t know where to post your thread, you can post on “where is the forum for” forum. Someone knows your problem will help moving to the appropriate forum.
http://social.msdn.microsoft.com/Forums/en-US/home?forum=whatforum.
Regards,
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

UCCX 7.0 Errors on Event Viewer

Hi Team.
The customer was alerting us about errors that are showing in the Event Viewer UCCX 7.0 server (on Windows).
The errors in Event Viewer are:
Event Type: Error
Event Source: CSAgent
Event Category: Kernel Rule
Event ID: 256
Date: 3/13/2013
Time: 1:22:12 PM
User: N/A
Computer: UCCX02-SS-CRT1
Description:
The process 'C:\Program Files\Java\jre6\bin\jusched.exe' (as user UCCX02-SS-CRT1\Administrator) attempted to initiate a connection as a client on TCP port 80 to 137.254.16.112 using interface Wired\HP NC7782 Gigabit Server Adapter. The operation was denied.
===================================================================================
Event Type: Warning
Event Source: Storage Agents
Event Category: Events
Event ID: 1210
Date: 3/13/2013
Time: 1:17:32 PM
User: N/A
Computer: UCCX02-SS-CRT1
Description:
Drive Array Tape Drive Cleaning Required. The tape drive in Slot 0, SCSI bus 2, SCSI target 5 requires cleaning.
[SNMP TRAP: 3044 in CPQIDA.MIB]
===================================================================================
===================================================================================
Event Type:    Error
Event Source:    CTIStorageServer
Event Category:    None
Event ID:    4
Date:        3/21/2013
Time:        3:20:58 PM
User:        N/A
Computer:    UCCX01-SS-CRT1
Description:
FCCC2005 Network communication error (TRANSIENT).
===================================================================================
Event Type:    Error
Event Source:    CTIStorageServer
Event Category:    None
Event ID:    4
Date:        3/21/2013
Time:        3:20:58 PM
User:        N/A
Computer:    UCCX01-SS-CRT1
Description:
FCCC2015 The connection to the Desktop Chat Service has been lost. The program will attempt to reconnect automatically.
===================================================================================
Event Type:    Error
Event Source:    CTIStorageServer
Event Category:    None
Event ID:    4
Date:        3/21/2013
Time:        3:21:08 PM
User:        N/A
Computer:    UCCX01-SS-CRT1
Description:
FCCC2005 Network communication error (TRANSIENT).
===================================================================================
Event Type:    Error
Event Source:    CTIStorageServer
Event Category:    None
Event ID:    4
Date:        3/21/2013
Time:        3:21:08 PM
User:        N/A
Computer:    UCCX01-SS-CRT1
Description:
FCCC2015 The connection to the Desktop Chat Service has been lost. The program will attempt to reconnect automatically.
===================================================================================
These last four errors were shown and generated intermittent communication between the telephony server (CallManager) and the IPCC because all active calls were interrupted.
I searched online documentation but can not get anything to tell me the meaning of these errors, their causes and some plan of action.
I appreciate your support to understand why these errors and explain to the customer the cause of these.
Thanks.
Best Regards.
Ernesto Gonzalez

Hi,
1. CSA denying the Java periodical update process from contacting its server. This can be safely ignored (Java is the platform of UCCX but is updated with a UCCX update, updating Java separately is not necessary, and in fact, not recommended. However, Java contains this periodic update check and - as far as I know - it cannot be turned off programmatically).
2. Tape cleaning required - is there a tape drive attached to the server?
3-7. Temporary network communication issue.
G.

Missing events from several devices within event viewer

Hi
I'm running a CSM v4.1.0 which manages several FWSM blades and device contexts. Although all context share the same syslog policies within CSM the events off half of the contexts are not shown in the event viewer. I ran a sniffer on the server, so that I could verify that syslog messages from all contexts are arriving. But somehow the CSM ignores the syslog messages. All contexts are selectable within the "Custom Filter for Device" so the CSM should be aware off them. Well off course he should be aware, as he has all the configurations of the contexts. ;-)
What am I missing? Is it a bug? Is there a limitation to the number off supperted eventing devices?
Kind regards
Roberto

CSM event viewer supports events from the ASA/FWSM virtual contexts ony if each context is discovered in CSM configuration manager with separete mangement IP.
Please try to discover the contexts as independent devices with separate management IP.

Webiserver error in Event Viewer

Hello,
The following messages were displayed in the Event Viewer.
Event Type: Warning
Event Source: BusinessObjects_CMS
Event Category: General
Event ID: 33017
Date: XXXX
Time: XXXX
User: N/A
Computer:XXXX
Descripsion:
     It connects with server sqnjp031.Web_IntelligenceReportServer.webiserver and it is not effective revokable. Please reactivate the server.
The following messages were displayed from the system log of WAS three hours later.
0000034f LogAdapter    W   DCSV9421W: Socket Adderess /xx.xx.xx.xx:9354 General
networking problem occurred on socket address 。 Exception: java.lang.Exception: CheckAsyncConnectCB: Channel Framework Problem! A request for connection establishment was not completed after 235313 ms, (original timeout was 20000 ms). Connection: UnicastConnection@1723435808, address: xx.xx.xx.xx:9354 | 0, isOutbound: true, isValid: true (false false).
    at com.ibm.rmm.ptl.tchan.transmitter.PTransmitter$CheckAsyncConnectCB.timerExpired(PTransmitter.java:1300)
    at com.ibm.rmm.intrn.util.TaskManager.run(TaskManager.java(Compiled Code))
And Main CMS would be stopped.
Afterwards, all reports were not displayed, and it began to move normally after the BO server and Websphere were displayed.
OS：Windows2003 Server
BO：BO XI R2.1 SP3
WAS：Websphere6.0
Clustering is done by six BOAP servers.
Can anyone let me know how to resolve this issues?
Thanks in Advance

Hi,
Please try to add this account: NT AUTHORITY\SYSTEM.
More information for you:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 2012
https://social.technet.microsoft.com/forums/systemcenter/en-US/cd8a2c95-70db-4df6-b7f5-eedcc5d898c7/the-applicationspecific-permission-settings-do-not-grant-local-activation-permission-for-the-com
Event ID 10016 issue in SQL Cluster Server
https://social.technet.microsoft.com/Forums/sqlserver/en-US/c5a27692-05c0-4ee4-b97f-1ea438b4e5f7/event-id-10016-issue-in-sql-cluster-server?forum=sqldisasterrecovery
In addition, if there are any further requirements regarding SQL, here are some SQL forums below for you:
https://social.technet.microsoft.com/Forums/sqlserver/en-US/home?category=sqlserver&filter=alltypes&sort=lastpostdesc
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Cisco security Manager event viewer

Hello Experts,
Can any one help me to get any document to understand the Event viewer Action Field
Actions Like
Built
Permitted
teardown
deny
Please help me to known what each action exactly mean
Thanks for your help
Regards,
Prashant

I also experiencing the same error message whenever I try to install CSM 3.3.1, although I did not have any IME installed, and I could not find any IEV installed in my server. This problem happened when I not properly uninstalled CSM 3.3.1, but after successfully removed the application, when I try to install the software again, then this error message appeared. I have looked in all directories, registry editor, services, but still I unable to find IPS event viewer file. Please advice

IDSM, Event Viewer locality=OUT , can I change it?

Hello,
in ISDM event viewer I see both internal (private) and external (global) addresses have
"locality"=OUT.
Does anybody know if it makes sense to change it and how, I can't find where?
participants:
    attacker:
      addr: 10.7.51.233 locality=OUT
      port: 52593
    target:
      addr: 204.192.12.14 locality=OUT
      port: 80
      os:   idSource=learned type=linux relevance=relevant
actions:
    denyPacketRequestedNotPerformed: true
Thank you
Alexander

Alexander;
You can define Event Variables for specific IP address(es) and/or IP address ranges and, as a result, these variable names will appear in event Alerts as the "locality" of applicable hosts (in place of the default "OUT"). So, for example, you may define an Event Variable, LAN for your primary network (192.168.0.0-192.168.0.255), another Event Variable, DMZ (192.168.2.0-192.168.3.255) for a semi-protected segment located offyour firewall, and a final Event Variable, WEB_SERVERS (1.1.1.0-1.1.1.31) for you publicly-accessible web servers. These variable names will then be displayed in the event details.
Scott

Understanding Event Viewer

Could anyone recommend any good sites or resources for breaking down and learning about event viewer? Any info would be appreciated.
This topic first appeared in the Spiceworks Community

Hi, here are a few pages to get you started.http://www.7tutorials.com/basics-about-working-event-viewer-windowshttp://www.howtogeek.com/school/using-windows-admin-tools-like-a-pro/lesson3/Once you find the event then take the event id number and go Google it.IE: "Event id 4227" when put in a google search reveals;https://technet.microsoft.com/en-us/library/cc735929(v=ws.10).aspxAfter that it boils down to a bunch of reading. Experience helps once you start deciphering these events. Also try to think through the problem logically and start with the earliest event that you think is involved in whatever problem you are trying to solve. Usually the first error or warning is the culprit and may cause subsequent errors that may be misleading because the first one caused them to exist in the first place.

Event Viewer - Error/Warning

Hi,
I am seeing the following errors on the subcriber Event Viewer system log. Does anyone know what is causing this.
Event Type: Error
Event Source: BROWSER
Event Category: None
Event ID: 8032
Date: 4/28/2006
Time: 10:12:19 AM
User: N/A
Computer: CCM_SUB
Description:
The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{81B27D00-C66E-4969-A4CA-A2E89101A90E}. The backup browser is stopping.
Data:
0000: 05 00 00 00 ....
and also this
Event Type: Warning
Event Source: BROWSER
Event Category: None
Event ID: 8021
Date: 4/28/2006
Time: 10:12:19 AM
User: N/A
Computer: CCM_SUB
Description:
The browser was unable to retrieve a list of servers from the browser master \\CCM_PUB on the network \Device\NetBT_Tcpip_{81B27D00-C66E-4969-A4CA-A2E89101A90E}. The data is the error code.
Data:
0000: 05 00 00 00 ....
Cheers,
Rafiq.

http://www.cisco.com/en/US/products/sw/voicesw/ps556/prod_troubleshooting_guide_chapter09186a008011b369.html#wp1047403
Browser Service: Every 2 Hours, an Error Occurs in the Event Log on the Subscriber
Symptom
Error Message The browser server has failed to retrieve the backup
list too many times on transport \Device\netBT_Tcpip (c96xxx)
The backup browser is stopping.
Warning: The browser was unable to retrieve a list of servers from the browser master \\AACCMP1 on the network \Device\netBT_Tcpip (c96xxx) the data is the error code.
Probable Cause
Cause indicates a NIC card problem. You need to upgrade the OS to a newer version.
Corrective Action
Procedure
Step 1 If you have an MCS-7830 and build the OS with the new 2000.1.2 OS installation, run the OS upgrade version 2000.1.3 to fix the NIC card problem.
If this is not your problem, verify the following actions:
Step 2 Ensure that your WINS address is correct.
Step 3 Ensure that Enable NetBIOS over TCP/IP is chosen.
Step 4 Ensure that the WINS address is correct on the master browser \\AACCM1.
Cheers
Please rate post if helpful.

Event viewer warning

Hi!
So, the problem started after I moved the BusinessObjects XI 3.1 server from hardware environment to a virtual environment.
This is the event log warning:
Unable to contact server EEEL132.WebApplicationContainerServer on machine eeel132 to perform status notification. Please check the server's system log for errors.
EEEl132 is the hostname of the server.
Event ID is 33017
Source BusinessObjects_CMS
Any idea how to remove the warning from the event viewer and fix the problem?
Regards,
Tarvi

http://www.cisco.com/en/US/products/sw/voicesw/ps556/prod_troubleshooting_guide_chapter09186a008011b369.html#wp1047403
Browser Service: Every 2 Hours, an Error Occurs in the Event Log on the Subscriber
Symptom
Error Message The browser server has failed to retrieve the backup
list too many times on transport \Device\netBT_Tcpip (c96xxx)
The backup browser is stopping.
Warning: The browser was unable to retrieve a list of servers from the browser master \\AACCMP1 on the network \Device\netBT_Tcpip (c96xxx) the data is the error code.
Probable Cause
Cause indicates a NIC card problem. You need to upgrade the OS to a newer version.
Corrective Action
Procedure
Step 1 If you have an MCS-7830 and build the OS with the new 2000.1.2 OS installation, run the OS upgrade version 2000.1.3 to fix the NIC card problem.
If this is not your problem, verify the following actions:
Step 2 Ensure that your WINS address is correct.
Step 3 Ensure that Enable NetBIOS over TCP/IP is chosen.
Step 4 Ensure that the WINS address is correct on the master browser \\AACCM1.
Cheers
Please rate post if helpful.

4215 Java error: When connecting from IPS event viewer

Hello-
I received a java error when trying to connect to my 4215 with Cisco IPS event viewer. It is as follows:
IOException in open Subscription(): java.security.cert.CertificateExpiredException: NotAfter: Sunday March 29
Is the web server running on 10.x.x.x:443? Please check the communication parameters of the device.
I can set the date on my pc back to last week and all works fine like b4. I have tried updating my java to the latest version and created a new certificate from the IPS.
Any help would greatly be appreciated:
Thanks

Hi,
The issue can be resolved by following the steps as below
1.Login to the sensor.
2.Run the tls generate-key command.
3.Make sure the certificate is generated.
4.Add the device again. It should work now.
REf: http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_qanda_item09186a008025c533.shtml
Do rate if it helped.
Regards
Sridhar

Question on an error message in Event Viewer.

Hi,
I had a question on a error message in event viewer for BO 3.0
Error Message:
Tried to allocate 20 windows desktop but only able to allocate 17 of them.The system may have reached its windows desktop limit.Please contact your system administrator.
Source:CR Processing server.
I have seen this error message before in BOEXIR2 for DeskI services but never for Crystal Reports.
What is the change in 3.0 architecture due to which we receive this error message for cr processing server.
Thanks in advance.

Please post this query to the Business Objects Enterprise Administration forum:
BI Platform
That forum is monitored by qualified technicians and you will get a faster response there.
Thank you for your understanding,
Ludek

Changing the Event View Field Display Order on a Calendar

We'd like to change the display of a calendar event to show the Title on top and the time below. This is how it currently looks below. Is there a way to change it?
Orange County District Attorney

Hi,
According to your post, my understanding is that you wanted to change the Event View Field display order on a Calendar.
You need to insert the code below into a Content Editor Web Part.
<script type="text/javascript" src="http://code.jquery.com/jquery-1.10.2.min.js"></script>
<script type="text/javascript">
function changeCalendarOrder() {
$(".ms-acal-sdiv").each(function () {
var arr = $(this).find('div').toArray();
var temp;
temp = arr[0];
arr[0] = arr[2];
arr[2] = temp;
$(this).html(arr);
//alert($(this).html());
_spBodyOnLoadFunctionNames.push('calendarEventLinkIntercept');
// hook into the existing SharePoint calendar load function
function calendarEventLinkIntercept() {
var OldCalendarNotify4a = SP.UI.ApplicationPages.CalendarNotify.$4b;
SP.UI.ApplicationPages.CalendarNotify.$4b = function () {
OldCalendarNotify4a();
changeCalendarOrder();
</script>
The result is as below:
Thanks,
Linda Li
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Linda Li
TechNet Community Support

SCOM 2012 SP1 - Show on event view all snmp trap (SNMP monitoring work)

Hello everybody,
Sorry for my english, I write normaly in french, but we have more result in english.
I have a problem with SCOM 2012. I try to catch all snmp traps sended by a 2960 CISCO switch on a EventView with a specific rule (Authoring->Rule->Collection Rules -> Event Based -> SNMP Trap (Event) based on the object target "Node")
I creat a specific management pack juste for the rule and the views.
SNMP Monitoring - CISOC 2960 => It's OK, I can have the processor state, utilization, etc ...
SNMP Monitoring Ubuntu computer => It's OK, I can have all the state I want.
SNMP Traps => The switch or the computer send traps over the network, and I can see in wireshark, the server receive the traps
SNMP Service (Windows service) => Disabled
SNMP trap (Windows service) => Disabled
Health Service (Windows service) => Enabled
Port 162 UDP => Open and listenning by the MonitoringHost.exe
Firewall rules => Everythinks is OK
SNMP Trap send version is => 2c
SNMP Monitoring device version is => 2c
I try too many of solution on different web site like :
http://scom-2012.blogspot.ch/2012/07/setting-up-snmp-monitoring-in-scom-2012.html
http://social.technet.microsoft.com/Forums/systemcenter/en-US/731661b9-10a1-4d3f-ba83-8e84d25ab760/event-collection-for-network-devices-scom-2012
http://social.technet.microsoft.com/Forums/systemcenter/en-US/a15bce49-fb62-4fd4-93cf-f87c3b734d58/snmp-trap-based-monitoring?forum=operationsmanagergeneral
http://social.technet.microsoft.com/Forums/systemcenter/en-US/41f5b6ef-c8b9-461d-bdcb-81fde5a89f50/scom-2012-unable-to-monitor-snmp-traps?forum=operationsmanagergeneral
http://social.technet.microsoft.com/Forums/systemcenter/en-US/4051fbd1-06f1-49e0-9ad4-4cbe4d2d7d4d/discover-windows-computer-as-network-device-w-snmp?forum=operationsmanagerauthoring
http://technet.microsoft.com/en-us/library/hh563870.aspx
http://social.technet.microsoft.com/Forums/en-US/cad1d3f9-594f-4f06-a5aa-660ccc2e9192/snmp-trap-based-monitoring-in-scom-2012-sp1?forum=operationsmanagerauthoring
http://social.technet.microsoft.com/Forums/en-US/41f5b6ef-c8b9-461d-bdcb-81fde5a89f50/scom-2012-unable-to-monitor-snmp-traps?forum=operationsmanagergeneral
http://social.technet.microsoft.com/Forums/en-US/e05a1c8f-7280-4f80-86cf-aabb4269bb87/scom-2012-customizing-snmp-trap-event-data?forum=operationsmanagergeneral
http://social.technet.microsoft.com/Forums/en-US/6826f6a6-bbc3-444b-9b18-288d7fedac3e/scom-unable-to-monitor-snmp-traps?forum=operationsmanagergeneral
http://social.technet.microsoft.com/Forums/en-US/7cd1571a-d292-4efc-9921-5a068f6f1691/scom-2012-sp1-ur2-snmp-monitoring?forum=operationsmanagermgmtpacks
Do you know a workaround? Or a different way to catch all the traps from a network device and show them (traps) on a event views.
Thank you in advance.
KimBaxZ
Computer expert system technology

Hello Yan Li,
I read your link, and I found this :
The network devices must be discovered and registered as ICMPSNMP devices.
And when I make the dicovery the first time, ICMP doesn't work, so I put only SNMP. This morning I tried with ICMP and SNMP, but the same problem come to me. And I found the rootcause of the problem with this post : http://www.code4ward.net/main/Blog/tabid/70/EntryId/105/Troubleshooting-Network-Discovery-in-SCOM-2012.aspx
I allowed the SNMP service, ping, and Health Service, just after I try a second time to dicover my device and it's work (ICMP and SNMP).
I recreat all my management pack and the rule. And now it's work! Thank you very much for your help!!
Have a nice day
Best regards
KimBAxZ
Computer expert system technology

Cisco IDSM Event Viewer - Understanding Event ID

Similar Messages

Maybe you are looking for