Global Summary events

I wonder if anyone could explain the global summary thing to me again. I enabled my signature ?icmp time exceeded for a datagram sigid=2005?. My vms SecMon console now sometimes receives a global summary event for this signature. In the summary event we have the src and dst field recorded. Each time the GS event is received in the console it is the same src and dst. I ran ?packet display? from the CLI of the sensor and I have absolutely no icmp traffic from that src that I received in the GS event.
Could you tell me if the src address is the actual address that triggered the G. summary or do we just ignore the src an dst in this case.

Similar Messages

Global correlation events

I have an ASA 5510 with an SSM-10 module. I have global correlation turned on and updating. When I look at the dashboard's "Global Correlation Report" I see packets that have been denied by global correlation. Can someone tell me how global correlation events are logged? I'd like to be able to see the raw data associated with the global correlation.
Thanks.

Hi,
Take a look at this:
http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_collaboration.html#wp1065809
As can be seen, whenever "global correlation" causes any kind of action to be taken by the IPS it produces an alert unless the packet is being denied by "reputation filtering" which does not produce any kind of alert. Also, "This feature only applies to global correlation inspection where the traffic is allowed if no specific signature is matched".
I am not sure of all those fields in then alert but i have seen at least some of them. If you are not seeing any alerts with those fields, then global correlation may not be seeing any instances where it has had to modify the risk ratings and take appropriate actions for it, that is, you may not be receiving any kind of such packets from malicious hosts at all in the first place.
Also, if you have "reputation filtering" on, you might want to turn it OFF to ensure it is not causing this behavior.
Rregards,
Prapanch

Global class event handler not called

I am having a problem where I created a function module that instatiates an application log class. This application log class has methods ON_* for public events of other classes.
The function module then processes its routines and as a result some of these events are raised. Ex: The function module creates a Purchase order and in that class I have a public even PO_CREATED that is raised upon succesfull creation of the PO. The global class APPLICATION_LOG I created has a method ON_PO_CREATED for event PO_CREATED of class ZCL_MAT_PO.
I put a break point in the APPLICATION LOG method but is os not called.
ANy idea of what Iam doing wrong or missing?
Thanks,
Leo

Hi Leo, did you set the handler method?
SET HANDLER <method_name> FOR <object>.
Regards,
Rich Heilman

Passing global from Events

I am developing a test program. I am using the full PID control, A test routine with 20 steps. It is a semi automatic test. The operator has
a panel for input when an event occures. I am having dificulty trying to pass the global data from the event case to the test sequence.
I am sure it is very basic. When I choose the start event. I tried to pass the boolean state & and I tried passing a 0 or a 1.
No luck.
Philip
Attachments:
State Machine (Completed) Folder.zip ‏63 KB

Hi,
I looked at your State Enum VI. IT seems like you are trying to pass data through GV from a while loop at the top to the sequence structure at the bottom.
1. The bottom sequence structure is going to execuate only once, so it is not going to get the value that you intended to get. You can put a while loop around the sequence structure if you want, so that it will continue to poll for the GV.
2. If you pass data that way, you are going to run into racing condition. It is better to pass through between parallel section of code with a queue instead.
Yik
Kudos and Accepted as Solution are welcome!

Capturing global mouse events ?

Is it possible to capture mouse event generated outside the application as well, as if the java app is running and the user opens a explorer and clicks at something, how can i capture that action ?

not with pure Java. JNI with native code

IPhone events don't sync to iCal

Problem Summary:
Events created on my iPhone do not sync over to my iCal on my computer.
Tech Specs:
* iPhone 4S, running iOS 6.1.3
* MacBook Pro, running OS X 10.6.8
* Sync via cable directly onto mac (not wifi, not iCloud)
Potentially Useful Observations:
* Events created on iCal do sync back to iPhone; only iPhone --> iCal fails.
* Partially edited histories of events sometimes also sync as duplicates back to iPhone (ex: on iCal on my computer I create an event "event 4" to occur at 2 pm, then I edit it to be "event 5" at 4 pm instead, then I sync my phone. My phone will get both an "event 4" @ 2, and an "event 5" @ 4 appear in its mobile iCal app, while the iCal on my computer only retains the most recent version -- "event 5" @ 4).
* Roughly 1/3 to 1/2 the time I try to sync, I get the following error:
However, the phone is still connected, and I can continue to interact with it through iTunes after the failed sync. iCal event syncing fails regardless of whether or not this error occurs.
(Failed) Strategies I Have Tried to Fix / Diagnose the Problem:
* Restarting iTunes
* Restarting computer
* Creating a new "test calendar" in iCal (it experienced the same syncing problems)
* Trying both the "All Calendars" or "Selected Calendars" syncing options in the "Info" tab in the iTunes phone syncing menu
* Resetting sync history through iSync preferences
* Deleting the calendar cache file in ~/Library/Calendars.
* Various combinations of the above (although if there is a specific combo you think would work, please let me know in case I did not try it)
Any suggestions or pointers to other posts offering different suggestions beyond what I have already tried (I did some browsing before posting) would be greatly appreciated.
Many thanks,
Sean

I just encountered a similar problem after updating from Snow Leopard to Mountain Lion with my old iPod touch (iOS4). Phononic's suggestion to delete the cach file in ~/Library/Calendars is close. Try this:
- in iCal, make a backup (File>Export>Calendar Archive)
- close iCal.
- delete the ~/Library/Calendars directory (or rename it ~/Library/Calendars.bak)
- open up iCal. There should be no events.
- sync your device through iTunes. This should remove all entries on your device.
- in iCal, restore the backup (File>Import)
- sync your device through iTunes again. This should restore all entries.
Seems to work so far, but haven't tested it on all my devices yet.
In Mountian Lion, there is a trick to locate the \Library directory. In Finder, ,selct "GO", then press the <option> key. "Library" will appear in the dropdown. Calendars is in there.

How to intercept touchscreen events

Hi,Everyone
I can use RegisterRawInputDevices, Monitor global Touch events, but is there any way you can intercept it?
I try to write a touch screen gestures Software , used to control the desktop environment does not support touch software.
Anything that can Intercept method，please let me know.
thanks.
Another: When you touch the screen, the mouse cursor will move, how to Ban it?

看你英语不是很好，我就直接用中文说了吧，拦截可以用RegisterPointerInputTarget这个API，可以拦截所有touch消息，但是拦截后原来的消息就没办法传递下去，这就只能用InjectTouchInput模拟输出，但是这个模拟又很蛋疼，只能模拟第二次输入，会造成很多问题。。。总之你慢慢用这两个API折腾吧。。

Reorganizing Events in my Events Library

I am studying the iMovie '11 Help to figure out *how to re-organize my Events Library*. One lesson is How to move a clip from one Event to another. It says:
+To move video clips from one Event to another:+
+In the Event Library, click to select the Event with the video you want to move.+
+In the Event browser, select the clip or clips you want to move.+
+Drag the clips to the name of the other Event in the Event Library to which you want to move them.+
+Release the mouse button when you see the name of the Event highlighted.+
+Click OK.+
_My question is_, *Can I create a brand new folder in the Events Library and move clips from various other events into that new folder?* I ask because the Help explanation explains that we can move clips from one folder to another (existing) folder but it does not mention the possibility of creating a totally brand new folder.
Example: In five folders/Events, I have footage of various themes: (1) My dog watching ucks in the pool, (2) Inside the house new furniture, (3) My dog inside the house, (4) Baby birds in a nest growing up and leaving the nest. (5) Children laughing in bed.
There are five Events with a jumble of all of those themes. In this case, I will end up with five folders and five themes, so I will have to only rename the folders, BUT *what about the cases where I need more folders? Is it ok to create a new folder for those clips taken from other Events?*
I ask because I have been told over and over that iMovie is a very sensitive program that doesn't want us to be fiddling with the contents, or that we have to fiddle with them only while working in iMovie. I want to make sure that what I described is a legitimate kind of fiddling around, and not one which will lose me footage and audio as happened to me about ten years ago (after which I quit iMovie for a long time.)
-L
Message was edited by: Lorna from Hawaii

Hi Lorna,
for quite a while, I'm watching with admiration and a good portion of amusement (no offense meant!) your tenacity to win the struggle with movie-making in general and iM in special ...
in this case, we have to get less 'practical' advice, but more 'concept thinking':
in real-life, people like to store things in drawers - there's a drawer for socks, another for shirts. What if you need red socks for a red shirt? you have to search manually in both drawers.
now, computers: since iTunes, Apple tries to teach people to use tags: there's a big basket with socks AND shirts, but each has tags, (sock, red, wool, old, holes ... ). A computer is much faster than you to organize this mess: one click 'red' and you instantly get any red socks and red shirts!
back to movie making:
what you want is drawers (=folders), you can manually organize. The Big Brother of iMovie, FinalCut call them bins.
but you'll find in iM a knob with a key on it - KEYWORDS (tags)! it allows to tag each clip, or part of, with as much keywords you like ... hmm, you need.
the better you apply keywords to clips (and iM allows to use your very own keywords, adding 'dogs', 'birds', 'socks ...), the better - and faster - you'll find material for your Projects!
it is very different to real-life, and we do this discussion with ANY 'switcher', who doesn't trust that concept when importing their 45GBs/thousand 'drawers' music Libraries ... or, same in iPhoto.
face recognition is such a thing ... = I have to organize thousands of pics from my son's soccer team - the computer identifies in seconds each member of the team; a click later, I get all stills showing Player #2.... that is MUCH easier than manually searching in dozens of folders (2009? 2010? April? December? The Big Match? Training? ... )
... spend some time off the computer with a pencil and some sheets of paper. what are YOUR keywords? what are the properties, you're most searching of? make a list of your keywords. consider future usage too. and, you can add additional keywords later. keep it simple & short - after finding all 'birds' clips, you can search for the robin manually ...
summary:
Events are meant for a 'time' structure, not content.
Use Keywords.
have fun ...

Event handlers inheritence

Do You plan to add some inheritence into event handlers. Example: I have event defined in UIX page and i have same event registred at global level through PageBroker.
Do You know how can I handle event with same name before globally defined?

This isn't the way UIX currently works; if you need functionality of this sort, you'll want to implement a
custom registration mechanism. One thing you could
do is add a <javaClass> element to your pages:
<page ...>
<javaClass name="yourPackage.YourClass"/>
</page>...where YourClass extends DefaultUINodePageDescription and overrides getEventHandler() to return a custom EventHandler that first calls through to super.getEventHandler().handleEvent(...)), then looks
up a globally defined event handler. That's a pretty
sketchy description, but it would give you what you're
looking for.

Event 5858 from WMI-Activity

Many instances of Event 5858 from WMI-Activity are appearing in the Microsoft-Windows-WMI-Activity/Operational log.
An example of the event message text is "Id = {BA4361BF-423A-0001-1284-43BA3A42CD01}; ClientMachine = SERVER1; User = SERVER\bnf1; ClientProcessId = 928; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem;
ResultCode = 0x80041032; PossibleCause = Unknown
Is there a solution or a workaround?
Thanks.

The core problem for this set of issues is that the WMI error event ID 5858 is being generated generically and is not only representing functional error conditions.
Unfortunately, for application/backwards compatibility, we can’t just get rid of it, because people have gone to the effort of parsing the event (more below) to look for the instances where there is useful data.
Event 5858 is generated any time there is an error returned to the WMI client API. Many of these “errors” are behaviors that the client application handles (for example, checking
for something that is not present), so seeing event 5858 does not tell you enough. The user data section of the event has the information to explain if the problem is important, but it must be parsed. That makes this event hard to use for monitoring, so some
notes on that are at the end.
To understand WMI event 5858, the key elements are in userdata, specifically:
ResultCode – this tells you the real reason event is generated, and is the most valuable piece of information. More info is below, but searching TechNet for the ResultCode will
usually give you the information you need.
Operation – the relevant info follows “Start IWbemServices::”, and tells you what WMI was asked to do. This includes run a query, enumerate/create/delete instances, look for
a class, etc. There is a full list here: //msdn.microsoft.com/en-us/library/windows/desktop/gg196568(v=vs.85).aspx
User – it sometimes it helps to know what account was trying to do the Operation, particularly if the ResultCode is 0x80041003 – Access Denied.
ResultCode details: There is a good list of ResultCodes here: //support.microsoft.com/kb/295821.
The ones listed in this thread are:
0x80041032 – Call Cancelled. The client application cancelled the request that was made. That is almost always ignorable as a WMI error. The component or application (SCCM,
or Group Policy) for example) that was calling into WMI cancelled the request, and will likely generate its own event if it is important to do.
0x8004100A – Critical Error. This could be a significant problem, and should be investigated. The WMI infrastructure is not working properly. You can either use WMIDiag (see
this article: //blogs.technet.com/b/askperf/archive/2012/02/03/wmidiag-2-1-is-here.aspx)
or from an elevated command prompt run Winmgmt –VerifyRepository.
0x80041002 – Not Found. This is usually ignorable by itself. It means that WMI could not find the instance of a class that was requested, which is not unusual.
0x8004100F – Invalid Object. This could be a significant problem and should be investigated. It could be a problem where the WMI provider is badly written, or it could be an
issue within the WMI repository. See Troubleshooting below.
Operation details – This begins with “Start IWbemServices::”, then the actual operation, with parameters you can use to find out more info. Examples from the thread above are:
ExecQuery – run a WMI query. The structure is ExecQuery - <namespace> : <query>. Example is ExecQuery - root\CIMV2 : select * from Win32_OperatingSystem Where ProductType!=2
or ProductType!=3. You can use the PS command get-wmiobject –namespace (insert the namespace) –query “(insert the query portion)”
DeleteInstance – delete a specific instance of a WMI class. Looks like: DeleteInstance - <namespace>: <instance information>. Example is DeleteInstance - Root\Rsop\User\S_1_5_21_1447720405_913420198_1853421413_1156
: RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}".
CreateInstanceEnum – sets up to enumerate all instances of a class. Structure is CreateInstanceEnum - <namespace> : <classname>.
Troubleshooting:
As noted, some of the issues listed above are important to understand. There are some good topics on WMI Troubleshooting in TechNet, so I won’t try to repeat them. There is
a generally good article here:
technet.microsoft.com/en-us/magazine/2006.09.wmievents.aspx.
The most critical things to check for are repository issues, which you can do either using WMIDiag (see this article:
blogs.technet.com/b/askperf/archive/2012/02/03/wmidiag-2-1-is-here.aspx) or from an
elevated command prompt run Winmgmt –VerifyRepository, and confirm that the repository is in good shape.
Monitoring:
You have to parse event 5858 to get the critical info, so other events are easier to use
for monitoring. The most critical events to watch for relating to WMI are still in the Windows-Application log, not Microsoft-Windows-WMI-Activity/Operational log (where event 5858 is found). All of the most serious errors that will show up with an event 5858
will also have something in the Windows-Application log. Documentation for the most relevant events are listed in multiple topics under this reference:
//technet.microsoft.com/en-us/library/cc727020(v=ws.10).aspx
In summary:
Event 5858 is confusing, generally ignorable, and unfortunately not something we can get rid of easily. It does provide valuable information if you know how to parse it. The
most relevant information is the ResultCode in the UserData section – copy and paste that into a search of TechNet for meaningful information.

Register a global hotkey with Labview

I need to register a global hotkey, in Windows, in order to fire an
event in a top-level VI application.
I suspect it could be possible by accessing the Windows API but I
don't know how to link a global keystroke event with a labview event.
I use LV 8.2 and Windows XP.
Thanks in advance.

Monitoring keystrokes within a LabVIEW application can be done with the input VIs. There's an example called "Basic Input Demo" that ships with LabVIEW that shows you how to do this. Open the Example Finder and search for "keyboard".
However, it sounds like you want the LabVIEW application to receive the keystroke if you're in another Windows application, or diddling around in Explorer. Is this the case? If so, you can still use those VIs to monitor the keys. You just need to make sure you're not stealing some keystroke that another process is expecting.

AD Event Viewer Error: 1053

Hello,
I hope this is in the right forum....
I'm getting the following error in the event viewer. It is then followed by a warning, which is pasted below as well.
Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          1/14/2014 12:21:49 AM
Event ID:      1168
Task Category: Internal Processing
Level:         Error
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      SPROCKET.sprocket.superbikeschool.loc
Description:
Internal error: An Active Directory Domain Services error has occurred.
Additional Data
Error value (decimal):
1053
Error value (hex):
41d
Internal ID:
300068c
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-ActiveDirectory_DomainService" Guid="{0e8478c5-3605-4e8c-8497-1e730c959516}" EventSourceName="NTDS General" />
    <EventID Qualifiers="49152">1168</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>9</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2014-01-14T08:21:49.537Z" />
    <EventRecordID>14117</EventRecordID>
    <Correlation />
    <Execution ProcessID="752" ThreadID="1044" />
    <Channel>Directory Service</Channel>
    <Computer>SPROCKET.sprocket.superbikeschool.loc</Computer>
    <Security UserID="S-1-5-7" />
</System>
<EventData>
    <Data>1053</Data>
    <Data>41d</Data>
    <Data>300068c</Data>
</EventData>
Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          1/14/2014 12:21:49 AM
Event ID:      2886
Task Category: LDAP Interface
Level:         Warning
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      SPROCKET.sprocket.superbikeschool.loc
Description:
The security of this directory server can be significantly enhanced by configuring the server to reject SASL (Negotiate, Kerberos, NTLM, or Digest) LDAP binds that do not request signing (integrity verification) and LDAP simple binds that are performed
on a cleartext (non-SSL/TLS-encrypted) connection. Even if no clients are using such binds, configuring the server to reject them will improve the security of this server.
Some clients may currently be relying on unsigned SASL binds or LDAP simple binds over a non-SSL/TLS connection, and will stop working if this configuration change is made. To assist in identifying these clients, if such binds occur this directory
server will log a summary event once every 24 hours indicating how many such binds occurred. You are encouraged to configure those clients to not use such binds. Once no such events are observed for an extended period, it is recommended
that you configure the server to reject such binds.
For more details and information on how to make this configuration change to the server, please see http://go.microsoft.com/fwlink/?LinkID=87923.
You can enable additional logging to log an event each time a client makes such a bind, including information on which client made the bind. To do so, please raise the setting for the "LDAP Interface Events" event logging category to level 2
or higher.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-ActiveDirectory_DomainService" Guid="{0e8478c5-3605-4e8c-8497-1e730c959516}" EventSourceName="NTDS General" />
    <EventID Qualifiers="32768">2886</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>16</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2014-01-14T08:21:49.584Z" />
    <EventRecordID>14118</EventRecordID>
    <Correlation />
    <Execution ProcessID="752" ThreadID="1044" />
    <Channel>Directory Service</Channel>
    <Computer>SPROCKET.sprocket.superbikeschool.loc</Computer>
    <Security UserID="S-1-5-7" />
</System>
<EventData>
</EventData>
</Event>
I'm running Windows Server 2008 (not R2). The computer is a DC running only one domain, which only has about 6 computers on it.
Thanks,
Pete

For the first event, it is an internal error and I would recommend contacting Microsoft PSS to investigate about it if it does not appear.
For the second event, please refer to that: http://technet.microsoft.com/en-us/library/dd941829(v=ws.10).aspx
Just make sure that your AD-based systems / applications support LDAP signing before enabling it.
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Get Active Directory User Last Logon
Create an Active Directory test domain similar to the production one
Management of test accounts in an Active Directory production domain - Part I
Management of test accounts in an Active Directory production domain - Part II
Management of test accounts in an Active Directory production domain - Part III
Reset Active Directory user password

Event Log Replication on Cluster Server (MS Server 2003)

Please help me about the EnableEventLogReplication on SERVER 2003. I just saw the recommended on MS support about it.
"If the EnableEventLogReplication registry entry is set to 1, the cluster node replicates events in the event log to all other nodes in the cluster. Tools that monitor multiple
servers, report a single event multiple times, one time from each node. "
I have got the problem about event logs replicates and hard to summary event logs on all nodes. If I want to disable this function I would like to know the effect about this one. it will not replicates events and will not get any worse cases on the server
that my customer using? Could you please advise?

As you mentioned, if you disable EnableEventLogReplication, Event Log Replication will be disable for one or more node in the cluster or the entire cluster. One or more cluster node is down or has experienced a failure, and preventing Event Log Replication
from taking place.
Note: if you disable the replication at a specific node, replication of events from that node to other nodes is disabled. Other nodes that have the EnableEventLogReplication property turned on still replicate to that node. This only replicates the System,
Application and Security event logs.
http://support.microsoft.com/kb/229071/en-us
http://support.microsoft.com/default.aspx?kbid=224969

SAP NW Registering and Subscription to events published from WebSphere ESB

have a scenario where the customer wants WebSphere ESB to be the notification broker. The ESB will publish an event and SAP NW would subscribe to some of those message.
Can anyone tell me 1. How to set-up the SAP NW registration to certain events with WebSphere ESB 2. The best way to handle the mediation 3. The call to the SAP application
Is it possible to have the ESB aware of what events SAP NW subscribes to and then let the ESB do the mediation and call into SAP app using WebServices or the WebSphere Adapter?
Any ideas or suggestions would be helpful
Thanks

Hi John,
Regarding SAP application and events: See transaction "SWF_BAM" (Business Activity Monitoring Administration).
There you have two options:
- link the event to a message proxy to publicate the event to SAP Process Integration (formerly XI). The message proxy should be defined within PI. You can also use conditions to filter events before they are published to PI.
- link the event to an alert category which is defined with the SAP central alert framework (transaction "ALRTCATDEF"). This means that if an event is occuring then an alert can be triggered. The as as event linkage to message proxy, you can use conditions to select certain events to trigger an alert.
So basically you have to perform three steps:
1) Define event signature in the Enterprise Services Repository (ESR) like for any other service
2) Generate outbound proxy for the defined event
3) cast local mySAP events to the outbound proxy call configuration
By doing so you get local events being published as global business events to SAP PI.
Best regards
Michael

Setup Global Shortcut

Hi All
Hope somebody can help, I'm trying to setup a global function command on my Apache Pro. Nothing special, I just want to be able to hit one key (probably an F key of sorts) and no matter what I'm busy with, my iTunes must skip to the next track.
With iTunes up front, I would use the right arrow key but that means it must be the progam that's on the front layer and that's not always possible.
As an added bonus, it would be useful if when the key is pressed and the screen has gone into power save, that the action of pressing the key would not wake the screen.
Any bright ideas?

The function you wanted requires the support in iTunes. The global keyboard events require the detection from the application.
I don't think iTunes has such function. You can query this with Apple RMA.
I do know Logitech they have some media shortcut keys designed on their keyboards for PCs which can allow end users to directly invoke the media player (you can assign) and jump to the next/previous song.
However, MSI laptops don't have any built-in keyboards like this.

Global Summary events

Similar Messages

Maybe you are looking for