Forwarding events and clarifying events format information

Question

Hello.
I've set up source initiated subscription for auditing file system usage. I need to know what files are added or deleted to the file share resource and by whom. So, subscription is working, and I get such kind of event on
source server:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 08.07.2014 11:23:01
Event ID: 4663
Task Category: File System
Level: Information
Keywords: Audit Success
User: N/A
Computer: fileserver.example.com
Description:
An attempt was made to access an object.
Subject:
Security ID: EXAMPLE\username
Account Name: username
Account Domain: EXAMPLE
Logon ID:
Object:
Object Server: Security
Object Type: File
Object Name: *path_to_file_or_folder_here*
Handle ID:
Process Information:
Process ID: 0x4
Process Name:
Access Request Information:
Accesses: DELETE
Access Mask: 0x10000
The main thing I need from such event are username, path to file or folder and access information (delete here).
After transferring such event by event subscription the resulting event on the
collector server differs:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 08.07.2014 9:54:42
Event ID: 4663
Task Category: File System
Level: Information
Keywords: Audit Success
User: N/A
Computer: fileserver.example.com
Description:
An attempt was made to access an object.
Subject:
Security ID:
Account Name: username
Account Domain: EXAMPLE
Logon ID:
Object:
Object Server: Security
Object Type: File
Object Name: *path_to_file_or_folder_here*
Handle ID:
Process Information:
Process ID: 0x4
Process Name: %12
Access Request Information:
Accesses: %9
Access Mask: %10
So, I have username and path here, but I don't have Process Name, Accesses and Access Mask information -
Access I need most of all, without it such event is useless.
Subscription format is Events (RenderedText doesn't bring normal description and writes The description for Event ID 4663 from source Microsoft-Windows-Security-Auditing cannot be found. Either the component that raises this event is not installed on
your local computer or...). Dll-s and registry paths are the same, only adtschema.dll.mui creation date differs, but there is no registry link to this file anyway. Windows version on collecting and sending systems are 2008 R2. Locales are the same (US). So,
it there any solution? Thanks in advance.
Update. Parsing XML view of the event shows, that <Data Name="AccessList">%%1537</Data>
corresponding to "DELETE" note in General view presents here, but it's not shown. It is shown on the source server. Also, events with Process Name field displayed correctly on the collecting server, but not all of the events has Process Name
field. Any ideas?

Answer 1

Hi Queequack,
To forward Events, please follow this article and feedback:
Quick and Dirty Large Scale Eventing for Windows
Best Regards,
Anna Wang