Strange events in HH3 log

hi ive been noticing this in my event log since re contracting with BT to get rid of the traffic shaping also noticed it maybe causing lag for me when gaming online. what ive read this is something todo with BTs IPTV what i dont have?
16:02:56, 05 Sep. IN: BLOCK [5] Fragmented packet (IP 10.199.36.194->255.255.255.255 fragment_offset=2048)
16:02:22, 05 Sep. OUT: BLOCK [44] Advanced Filter Rule (fw/policy/0/chain/fw_ath2_out/rule/0: UDP 0.0.0.0:68->255.255.255.255:67 on ath2)
16:02:20, 05 Sep. BLOCKED 1 more packets (because of Advanced Filter Rule)
16:02:19, 05 Sep. OUT: BLOCK [44] Advanced Filter Rule (fw/policy/0/chain/fw_ath2_out/rule/0: UDP 10.106.142.122:68->255.255.255.255:67 on ath2)
16:01:42, 05 Sep. IN: BLOCK [12] Spoofing protection (IGMP 109.152.230.75->224.0.0.22 on ppp1)
16:00:19, 05 Sep. OUT: BLOCK [15] Default policy (First packet in connection is not a SYN packet: TCP 192.168.1.10:58424->157.56.126.168:443 on ppp1)
15:59:42, 05 Sep. IN: BLOCK [12] Spoofing protection (IGMP 109.152.230.75->224.0.0.22 on ppp1)
15:59:31, 05 Sep. IN: BLOCK [15] Default policy (TCP 66.193.112.93:443->109.152.230.75:34006 on ppp1)
15:59:24, 05 Sep. BLOCKED 2 more packets (because of Spoofing protection)
15:59:23, 05 Sep. BLOCKED 3 more packets (because of Spoofing protection)
15:59:22, 05 Sep. IN: BLOCK [12] Spoofing protection (IGMP 192.168.1.254->224.0.0.22 on eth1)
15:59:22, 05 Sep. BLOCKED 1 more packets (because of Spoofing protection)
15:59:22, 05 Sep. IN: BLOCK [12] Spoofing protection (IGMP 192.168.1.254->224.0.0.22 on eth1)

I had got the same logs after the HH3 had it's update last December and tried all the fixes but to no effect, you will still get loads of logs.
The difference between original firmware and new the firmware is that the HH3 is now showing you Firewall logs which it never did before the update, so you can relax it's normal

Similar Messages

BT HH3 Log files

Hi,
Not sure if this is the right place for this and sorry if I get some of the terminology wrong but here goes anyway...
Does anyone know...
What does "This packet may be from VPN server initiator" mean ? I sort of understand VPN and do not have this set up.  Could someone be trying to discover (paranoid?) what LAN IPs the HH3 is allocating?
and
Is it at all possible to read/write HH3 log files from the WAN side??? I have entries in the Open WiFi part of the log that are apparently timed when the hub was supposed to be in power saving mode - it was set to 'down itself' at 22:30 on the dates shown (and switched off from 18 May to 25 May).
From WiFi log:
19:30:53,02 Jun.
WiFi Up
  19:30:52,02 Jun.
WiFi Down
  22:31:01,01 Jun.
Client disassociated: etc etc, Reason Code 4
  22:31:01,01 Jun.
WiFi Down
  19:34:16,01 Jun.
Client associated:etc etc, Link Rate 26.0 Mbps
  19:31:02,01 Jun.
WiFi auto selected 20M channel 11 (Restart)
  19:31:02,01 Jun.
1-86, 1::2-86, 0::3-86, 0::4-86, 0::5-87, 0::6-87, 1::7-87, 0::8-87, 0::9-87, 0::10-87, 0::11-87, 0::12-87, 0::13-85, 0
  19:30:56,01 Jun.
WiFi Up
  19:30:56,01 Jun.
WiFi Down
22:30:21,25 May.
WiFi Down
  21:34:32,25 May.
Client associated: etc etc, Link Rate 1.0 Mbps
  00:00:23,01 Jan.
WiFi auto selected 20M channel 6 (Power-up)
  00:00:23,01 Jan.
1-85, 1::2-85, 0::3-84, 0::4-85, 0::5-83, 0::6-86, 0::7-86, 0::8-86, 0::9-86, 0::10-85, 0::11-86, 0::12-86, 0::13-84, 0
  00:00:17,01 Jan.
WiFi Up
  00:00:17,01 Jan.
WiFi Down
  22:30:23,17 May.
Client disassociated: etc etc, Reason Code 4
  22:30:23,17 May.
WiFi Down
  21:58:50,17 May.
Client associated:etc etc, Link Rate 19.5 Mbps
  19:30:22,17 May.
WiFi auto selected 20M channel 1 (Restart)
  19:30:22,17 May.
1-86, 0::2-86, 0::3-85, 0::4-86, 0::5-86, 0::6-87, 1::7-87, 0::8-87, 0::9-87, 0::10-87, 0::11-87, 0::12-87, 0::13-86, 0
  19:30:17,17 May.
WiFi Up
  19:30:16,17 May.
WiFi Down
and why are there 01 Jan entries inserted?
From Open WiFi log:
23:55:22,01 Jun.
This packet may be from VPN server initiator
  23:55:06,01 Jun.
This packet may be from VPN server initiator
  23:54:58,01 Jun.
This packet may be from VPN server initiator
  23:54:54,01 Jun.
This packet may be from VPN server initiator
  23:54:52,01 Jun.
This packet may be from VPN server initiator
  23:54:52,01 Jun.
This packet may be from VPN server initiator
  02:31:37,17 May.
This packet may be from VPN server initiator
  20:17:07,15 May.
OpenWiFi tunnel down
If you got this far,
Thanks for taking time to read/think about this
Wildwood.

If you have a HomeHub the event logs should be under troubleshooting -> Event Log

Maximum number of events per audit log file must be greater than 0.

BOE-XI (R2)
Windows Server 2003
Running AUDIT features on all services.
Report Application Server (RAS) keeps giving the following error in the Windows Application Event Log.
Maximum number of events per audit log file must be greater than 0. Defaulting to 500.
I am assuming that this is because the RAS is not being used by anyone at this time - and there is nothing in the local-audit-log to be copied to the AUDIT database.
Is there any way to suppress this error...?
Thanks in advance for the advice!

A couple more reboots after applying service pack 3 seemed to fix the issue.
Also had to go to IIS and set the BusinessObjects and CrystalEnterprise11 web sites to use ASP .NET 1.1 instead of 2.

Failed to query Alarms & Events, alarms not logging

Hi all,
I've recently run in to an issue with the DSC Alarm & Event logging. I have a number of shared variable libraries all setup to log both data and alarms to Citadel. I've double checked that the library itself is configured for logging data and alarms, as well as all the variables. Using the DSM, I can see all of the active alarms in the system across all libraries, and can receive all alarm change events programmatically.
For some reason, alarms for only one of the libraries are logging, and attempting to query the historical Alarms & Events through MAX throws an error roughly 14 out of 15 times (with no error code or indication of why it fails). I've also attempted to archive the Citadel database, with it failing with an unspecified error (presumably when archiving the alarms side of things, the data archive seemed to work).
Can anyone offer some insight on how to resolve the problem, preferably without data loss? Further, how can I prevent the issue in future?
Solved!
Go to Solution.

Thanks for your reply Joey.
Libraries are being deployed using the DSC Deploy Libraries VI. The libraries also have data and alarm logging enabled programmatically. At the moment they're both being logged to the same database.
I can't find the "Read Historical Trend.vi" through the DSC Examples. The article was written in 2005 and I'm using DSC 2012 SP1, so I don't know if things have changed since then. I can view the data through MAX without issue if that's any consolation.
The mdf file is about 60MB, with the entire Citadel database at around 6GB.
The Citadel service is definitely running. I've also attempted restarting it (and the PC itself) but the issue is still present.
It's entirely possible there was a power failure, as this has been during a period of plant commissioning. When I can query the alarms through MAX there's a lot of data up to a certain point (end July), then it's very sporadic after that with only certain variable's alarms being logged.
I attempted another database archive and this time it managed to get all the way through, though the archived database also has the same problems querying alarms and events. So at this point I suspect the mdf/mds files are corrupt in some way.
Using the DSM, I've tried manually pointing the libraries to log alarms to a newly created database but this doesn't seem to work. No alarms or events are logged to the new database, and checking the library properties shows that the alarm database which I configured the library to log to had reverted to the original database. Am I missing something obvious here? Do I need to pre-create some traces in the new database before alarms and events will get logged there?
Given I have managed to make a 'good' archive of the database, I'd like to try just deleting the alarms and events portion of the database and start clean. Is there a correct way to do this? I did find this article, but am unsure if this will work with a potentially corrupted database: http://digital.ni.com/public.nsf/allkb/9D3A81218264C68686256DE1005D794F If I stop all of the Citadel and SQLServer related services, can I simply delete the mdf/mds files?

Error about the dll crdb_dao.dll - In Event Viewer - Application log

We have classic ASP application and we are using Crystal XI for reports viewing and printing. We are keep getting the following error logged in the event view application log.
Faulting application dllhost.exe, version 5.2.3790.3959, faulting module crdb_dao.dll, version 11.0.0.1282, fault address 0x0001b130.
What is Causing this error. When this happens, the components stops responding and we have re-start the server.

Hi ABC,
CR XI is past it's patch life cycle so all I can suggest is you download the last Service Pack and test again. If it still happens then you can update to XI R2 and try again.
You can get to downloads from here: http://service.sap.com/sap/bc/bsp/spn/bobj_download/main.htm
And to upgrade go to this link: http://www.sdn.sap.com/irj/boc and download the trial version of CR XI R2 and use your XI keycode, then apply the patches which you can get to by clicking on the BusinessObjects tab above, then Downloads.
Direct link to the Trial version: http://www.sap.com/solutions/sapbusinessobjects/sme/freetrials/index.epx
Thank you
Don

Strange lines in messages.log

Hi all,
we have RAC installation with two nodes. On both of them is some strange message in /var/log/messages.log written twice per second. Because of this messages.log is growing in size very fast.
I'm totally confused which process is responsible using sudo and generating such records.
Here are few lines......
Mar 10 14:14:06 fst1333x su: (to oracle) root on none
Mar 10 14:14:06 fst1333x su: (to oracle) root on none
Mar 10 14:14:08 fst1333x su: (to oracle) root on none
Mar 10 14:14:08 fst1333x su: (to oracle) root on none
Mar 10 14:14:09 fst1333x su: (to oracle) root on none
Mar 10 14:14:09 fst1333x su: (to oracle) root on none
Mar 10 14:14:10 fst1333x su: (to oracle) root on none
Mar 10 14:14:10 fst1333x su: (to oracle) root on none
Mar 10 14:14:11 fst1333x su: (to oracle) root on none
Mar 10 14:14:11 fst1333x su: (to oracle) root on none
Mar 10 14:14:12 fst1333x su: (to oracle) root on none
Mar 10 14:14:13 fst1333x su: (to oracle) root on none
Mar 10 14:14:14 fst1333x su: (to oracle) root on none
Mar 10 14:14:14 fst1333x su: (to oracle) root on none
Mar 10 14:14:15 fst1333x su: (to oracle) root on none
Mar 10 14:14:15 fst1333x su: (to oracle) root on none
Mar 10 14:14:16 fst1333x su: (to oracle) root on none
Mar 10 14:14:16 fst1333x su: (to oracle) root on none
Mar 10 14:14:17 fst1333x su: (to oracle) root on none
Mar 10 14:14:17 fst1333x su: (to oracle) root on none
Mar 10 14:14:19 fst1333x su: (to oracle) root on none
Mar 10 14:14:19 fst1333x su: (to oracle) root on none
Mar 10 14:14:20 fst1333x su: (to oracle) root on none
Mar 10 14:14:20 fst1333x su: (to oracle) root on none
Mar 10 14:14:21 fst1333x su: (to oracle) root on none
Mar 10 14:14:21 fst1333x su: (to oracle) root on none
Mar 10 14:14:22 fst1333x su: (to oracle) root on none
Mar 10 14:14:22 fst1333x su: (to oracle) root on none
Mar 10 14:14:23 fst1333x su: (to oracle) root on none
Mar 10 14:14:23 fst1333x su: (to oracle) root on none
Mar 10 14:14:25 fst1333x su: (to oracle) root on none
Mar 10 14:14:25 fst1333x su: (to oracle) root on none
Mar 10 14:14:26 fst1333x su: (to oracle) root on none
Mar 10 14:14:26 fst1333x su: (to oracle) root on none
Mar 10 14:14:27 fst1333x su: (to oracle) root on none
Mar 10 14:14:27 fst1333x su: (to oracle) root on none
Mar 10 14:14:28 fst1333x su: (to oracle) root on none
thanks for your suggestions
Robert

Hi Chandra,
unfortunately I can't stop the whole database just because of this "little" problem. And don't even know if it really helps. Now I'm installing the same SW on VMWare server. Hope, that it will help me reproduce this problem and then I can try this patch.
Thank you, however, for your suggestion.
Robert

Config event generator to log when file didn't arrive at certain time?

hi everyone
is it possible to configure a file event generator to write a log if certain files did not arrive at pre-defined time? or any event generator to log if certain events did not happen at specified time? thanks in advance.
Message was edited by chendongtom at Sep 13, 2004 10:23 AM

Hi,
I don't think, it is possible.
What you can do is:
Don't use file EG, but a timer EG, which kicks off a workflow, using a file control to look for/read in/.. the file and do some reporting afterwards.
You do not have to kick-off the workflow at the exact time, but also can do it 2 hours (for example) before and use a timer inside the workflow for watching a time period for the arrival of the file.
Keep in mind that WLI timers are not 100% exact because they are JMS based, so it is guranteed not to be started before, but can start a little bit later than start-time.
If you are using already a scheduling system like Control-
M, you can also leverage this to start the workflow.
-Kai

I can no longer use all of the "Computer Management" tools against a remote computer. "Local Users and Groups", "Event Viewer", "Performance Logs and Alerts" and "Device Manager"

Hello All,
I can no longer use all of the "Computer Management" tools against a remote
computer. "Local Users and Groups", "Event Viewer", "Performance Logs and
Alerts" and "Device Manager"
kindly see the below snapshot for assistance
REGARDS DANISH DANIE

This link may help....
http://windowsxp.mvps.org/admintools.htm
Freeman

Strange events in homehub 5 log but got speed incr...

Had hh5 since October had no problems with speeds always good yesterday Vdsl stats was on 66195 down & 20000 up all good but this morning it rebooted speed gone up to 69350 upload the same but logs really strange as showing (3621.280000) OpenRG will go down for reboot in 5 seconds never seen this before but an hour later rebooted again and speeds went back to previous here's the logs any ideas ?
07:05:17, 22 Jan. (259336.180000) CWMP: session completed successfully
07:05:17, 22 Jan. (259335.970000) CWMP: HTTP authentication success from https://pbthdm.bt.mo
07:05:15, 22 Jan. (259333.890000) CWMP: Server URL: https://pbthdm.bt.mo; Connecting as user: ACS username
07:05:15, 22 Jan. (259333.890000) CWMP: Session start now. Event code(s): '4 VALUE CHANGE'
07:05:15, 22 Jan. (259333.670000) CWMP: Initializing transaction for event code 4 VALUE CHANGE
07:03:53, 22 Jan. (259251.430000) CWMP: session completed successfully
07:03:51, 22 Jan. (259249.880000) CWMP: HTTP authentication success from https://pbthdm.bt.mo
07:03:49, 22 Jan. (259247.350000) CWMP: Server URL: https://pbthdm.bt.mo; Connecting as user: ACS username
07:03:49, 22 Jan. (259247.350000) CWMP: Session start now. Event code(s): '7 TRANSFER COMPLETE,M Download,4 VALUE CHANGE'
07:03:48, 22 Jan. (259247.140000) CWMP: Initializing transaction for event code M Download
07:03:48, 22 Jan. (259247.140000) transfer completed successfully
07:03:46, 22 Jan. (259244.510000) CWMP: session completed successfully
07:03:45, 22 Jan. (259244.240000) CWMP: Download file, FileType=4, FileName=5a-1.7-testpackage-package.tar.gz.aes.rsa.signed, Username=, CommandKey=1326944575
07:03:45, 22 Jan. (259244.020000) CWMP: HTTP authentication success from https://pbthdm.bt.mo
07:03:44, 22 Jan. (259242.460000) CWMP: Server URL: https://pbthdm.bt.mo; Connecting as user: ACS username
07:03:44, 22 Jan. (259242.460000) CWMP: Session start now. Event code(s): '6 CONNECTION REQUEST,4 VALUE CHANGE'
07:03:43, 22 Jan. (259242.260000) CWMP: Initializing transaction for event code 6 CONNECTION REQUEST
07:03:42, 22 Jan. (259240.590000) CWMP: session completed successfully
07:03:42, 22 Jan. (259240.380000) CWMP: HTTP authentication success from https://pbthdm.bt.mo
07:03:39, 22 Jan. (259237.650000) CWMP: Server URL: https://pbthdm.bt.mo; Connecting as user: ACS username
07:03:39, 22 Jan. (259237.640000) CWMP: Session start now. Event code(s): '2 PERIODIC,4 VALUE CHANGE'
(259736.190000) PPP LCP Send Termination Request [User request]
07:11:56, 22 Jan. (259734.290000) The system is going DOWN for reboot.
07:11:56, 22 Jan. (259734.290000) OpenRG is going for reboot by IPC command
07:11:51, 22 Jan. (259729.290000) OpenRG will go down for reboot in 5 seconds
Then an hour later
08:12:50, 22 Jan. ( 3626.280000) The system is going DOWN for reboot.
08:12:50, 22 Jan. ( 3626.280000) OpenRG is going for reboot by IPC command
08:12:45, 22 Jan. ( 3621.280000) OpenRG will go down for reboot in 5 seconds
Latest Vdsl stats
1. Product name: BT Home Hub
2. Serial number: +068343+NQ33645431
3. Firmware version: Software version 4.7.5.1.83.8.173.1.6 (Type A) Last updated 24/12/13
4. Board version: BT Hub 5A
5. VDSL uptime: 0 days, 00:12:21
6. Data rate: 20000 / 67423
7. Maximum data rate: 21277 / 67193
8. Noise margin: 6.2 / 6.6
9. Line attenuation: 0.0 / 16.8
10. Signal attenuation: 0.0 / 16.8
Strange that the data rate is higher than the maximum speeds ?

Well my home hub 5 rebooted 3 times yesterday due to this openRG activity which seems to be a pushed trial version of new firmware 1.7 it's been downloaded to my hub but not activated as of yet lucky enough it has not effected DLM as of yet speeds still the same around 68 down 19 up but really annoyed as bt have not informed us of this, a simple email would be enough to keep us in the loop but that's asking to much I guess?

Event viewer filtered log not exported correctly

Hi all,
I have a very strange problem, or better, I'm missing something.
I can open the event viewer and there are many events in there (45'000). I can filter for the last 7 days and this shows me only 1925 events which is correct.
Now, if I click on SAVE FILTERED LOG FILE AS, I can save the file in XML or TXT format (or others). It's not important the format because the export is incorrect! What I mean is that once the file has been exported to a TXT or others file's format, it contains
just some events, in this case maybe 50-60 events, not more! The strange thing is that in that file I can see ONLY the events from the most recent day in the filter (right now the 14 of june).
Now the funny part: if I save THE SAME LOG as .XML, it doesn't show all the events, but more than the TXT file (in this case, it shows until the 2nd of june), but the last event on the filtered event viewer, is on 13 may.
I hope somebody can help me, and excuse me for my explanation.

Hi ripp3r,
Thank you for your post.
I test to save event log following your description with same result. When I save log to evtx format file, the log show correctly.
Then I find KB2417105 (for Windows 2008) to express that logs are truncated because the saving event log operation is not synchronized appropriately with the fetching-event operation.
When I installed the KB2417105, event log saved to txt file successful.
If your server OS is Windows 2008 R2, please install
KB981466.
If there are more inquiries on this issue, please feel free to let us know.
Regards,
Rick Tan

Strange problem with database log in...

Hi all,
I am doing a small interface which will contain the name and password textField for user to log in.
The strange thing is, the program doesn't go through the line
       rec = st.executeQuery( "SELECT * FROM tbladmin WHERE Name ='"+nField.getText()+"' AND Password = '"+pField.getText()+"'" );If I try to display some message before this line, it showing properly but if after that line, nothing happen.
import java.sql.*;
import javax.swing.*;
import java.awt.event.*;
import java.awt.*;
import java.util.*;
import java.text.*;
import java.awt.geom.*;
import java.awt.image.*;
import javax.swing.border.*;
import java.text.DecimalFormat.*;
public class admin extends JFrame implements ActionListener
    private Container cont;
    private GridBagLayout lay;
    private GridBagConstraints cons;
    private JLabel mainLabel = new JLabel(" Daddy Care Web Browser Administrator System ");
    private JLabel nLabel = new JLabel(" Name ");
    private JLabel pLabel = new JLabel(" Password ");
    private JTextField nField = new JTextField(20);
    private JTextField pField = new JTextField(20);
    private JButton vButtons[];
    private String vButtonnames[] = {" Log In ", "Exit"};
    private String data= "jdbc:odbc:admin";
    private String driver = "sun.jdbc.odbc.JdbcOdbcDriver";
    private Connection conn;
    private Statement st;
    private ResultSet rec;
    private PreparedStatement ps;
   GridBagLayout gb = new GridBagLayout();
   Panel Pane1 = new Panel(gb);
   boolean option1 = false;
    /** Creates a new instance of dmp */
    int i =0;
public void actionPerformed(ActionEvent e)
        int i =0;
        if(e.getSource() == vButtons[0])
            try{
            ps = conn.prepareStatement(" SELECT * FROM tbladmin ");
           // st = conn.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,ResultSet.CONCUR_UPDATABLE);
            rec = st.executeQuery( "SELECT * FROM tbladmin WHERE Name ='"+nField.getText()+"' AND Password = '"+pField.getText()+"'" );
            boolean more = rec.next();
            if(!more)
                JOptionPane.showMessageDialog(null,"wrong ler....");
                else
                JOptionPane.showMessageDialog(null,"wahaha !!!");
           // dispose();
            catch(SQLException ex)
         if(e.getSource()== vButtons[1])
            System.exit(0);
    public admin ()
        super("Daddy Care Website Filter");
        setSize(500,200);
        int i;
        cont = getContentPane();
        lay = new GridBagLayout();
        cont.setLayout(lay);
        try
             Class.forName(driver);
       catch(ClassNotFoundException c)
           { System.err.print("ClassNotFoundException: ");System.err.println(c.getMessage());}
       catch (Exception s)
           { s.printStackTrace(); }
      /* Open Connection */
       try
            conn = DriverManager.getConnection(data,"","");
            st = conn.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,ResultSet.CONCUR_UPDATABLE);
            rec = null;
       catch(SQLException ex)
                   System.err.println("SQLException: " + ex.getMessage());
               if (conn != null)
                    try
                         System.err.print("Transaction is being ");
                         System.err.println("rolled back");
                         conn.rollback();
                                catch(SQLException excep)
                         System.err.print("SQLException: ");
                         System.err.println(excep.getMessage());
        cons = new GridBagConstraints();
        vButtons = new JButton[vButtonnames.length];
        for( i=0; i<vButtonnames.length;i++ )
             vButtons= new JButton(vButtonnames[i]);
vButtons[i].addActionListener(this);
cons.weightx = 5;
cons.weighty = 1;
cons.gridwidth = GridBagConstraints.REMAINDER;
addComponent(mainLabel);
cons.gridwidth = GridBagConstraints.EAST;
addComponent(nLabel);
cons.gridwidth = GridBagConstraints.REMAINDER;
addComponent(nField);
cons.gridwidth = GridBagConstraints.EAST;
addComponent(pLabel);
cons.gridwidth = GridBagConstraints.REMAINDER;
addComponent(pField);
cons.gridwidth = GridBagConstraints.REMAINDER;
addComponent(vButtons[0]);
cons.gridwidth = GridBagConstraints.REMAINDER;
addComponent(vButtons[1]);
setSize(300,200);
setVisible(true);
private void addComponent(Component component)
lay.setConstraints(component, cons);
cont.add(component);
public static void main(String args[])
admin a = new admin();
a.setDefaultCloseOperation(JFrame.EXIT_ON_CLOSE);
The name of the adatabase and the table for it is ' admin ' and that are only 2 field in the table "Name" and Password".
Can somebody help me in this? THANKS !!!

#As long as you put in statements like
catch(SQLException ex)
                { };you don't deserve any help. Sorry.

Event 4740 Not Logged for a Single Account Lockout

Domain Functional Level: 2003
PDC Emulator: 2008 R2
Lockout Origin DC (also the RADIUS server): 2003 R2
For quite a while now I have been relying on Event 4740 on the PDC Emulator to track account lockouts. Usually when the RADIUS server causes an account lockout, the Caller Computer Name is blank in the Event 4740. This usually tells me that our
Cisco WLAN Controller caused the lockout.
Our Default Domain Policy is set to audit Account Logon Events for failure, Account Management for success/failure, and Logon Events for success/failure (plus numerous other things).
This time there is no Event 4740 for this account lockout and I can't figure out why. The events are there for other lockouts several minutes before or after this one. Windows just hates me so it decided to skip this one. The main reason
this is a problem is because I just set up Scheduled Task on the PDC Emulator, triggered by Event 4740, to run a PowerShell script that will provide the help desk with a report for each account lockout, even parsing the IIS logs on the Client Access Server
to identify which ActiveSync device caused it. Of course the week after I announce that, Windows decides not to log one.
Using LockoutStatus.exe I determined that the Origin DC for the lockout was the RADIUS server.
NetLogon debug logging is enabled on the RADIUS server, however I took a nap today after being let out of work early for the holiday so by the time I checked the netlogon.bak file it had already been overwritten with newer data.
There was, however, an Event 644 locked on the RADIUS server (pasted below with domain/computer/user details edited for privacy). I don't even know where to start as far as trying to prevent this from happening again. Anyone have any suggestions?
Within the next couple months I will spin up a 2012 RADIUS server and a separate 2008 R2 DC to replace the 2003 multipurpose server, but it's not high on my boss's priority list so it's a tough sell considering the WLAN is functional right now.
Event Type: Success Audit
Event Source: Security
Event Category: Account Management
Event ID: 644
Date: 12/31/2014
Time: 10:00:35 AM
User: NT AUTHORITY\SYSTEM
Computer: DomainControllerAndRadiusServer
Description:
User Account Locked Out:
Target Account Name:
LockedOutUser
Target Account ID:
DOMAIN\LockedOutUser
Caller Machine Name:
CISCO
Caller User Name:
DomainControllerAndRadiusServer$
Caller Domain:
DOMAIN
Caller Logon ID:
(0x0,0x3E7)
For quite a while now I have been relying on Event 4740 on the PDC Emulator to track account lockouts. Usually when the RADIUS server causes an account lockout, the Caller Computer Name is blank in the
Event 4740. This usually tells me that our Cisco WLAN Controller caused the lockout.
For quite a while now I have been relying on Event 4740 on the PDC Emulator to track account lockouts. Usually when the RADIUS server causes an account lockout, the Caller Computer Name is blank in the
Event 4740. This usually tells me that our Cisco WLAN Controller caused the lockout.
For quite a while now I have been relying on Event 4740 on the PDC Emulator to track account lockouts. Usually when the RADIUS server causes an account lockout, the Caller Computer Name is blank in the
Event 4740. This usually tells me that our Cisco WLAN Controller caused the lockout.

Hi,
I suggest you use Auditpol command to check the current auditing status on Domain Controller.
You can type this command below:
Auditpol /get /Category:Logon/Logoff
If the Account Lockout subcategory is set to no auditing, please use /set option to enable auditing:
Auditpol /set /Subcategory:”Account Lockout” /Success:enable /Failure:enable
More information for you:
Auditpol
http://technet.microsoft.com/en-us/library/cc731451.aspx
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Using event risen to log data into citadel

Hi all,
I have an HMI application in LV & DS 8 reads My OPC items, and log data, alarms and events into citadel. Knowing Citadel is event-driven, I want to use this event to distinguish a change in database and update my Historical Alarm & Even List in the HMI front panel instead of ever polling the database.
I really appreciate any help.

Can you post more information on what you are doing? I haven't done much with Citadel but I thought that it is aimed at logging data as it changes, i.e. all of the data logged in there will be different else it wouldn't have been logged in the first place?!
There are block diagram functions that allow you to read the traces back and this is all you need. Check out the examples that come with the DSC module.
Let me know if I can help you further.

Where are my Event logger's logs of Info level severity?

Hi,
How can I get my logs reflected in NWA log viewer of INFO level severity which were generated by EVENT LOGGER action block in one of my transactions. Currently I am able to view logs of severity ERROR and above in Log Viewer. But I am not able to populate logs of severity below ERROR level.
I understand that some settings are required in Log configuration in NWA. But I am clueless after that.

Piyush,
There are two areas that this needs to be set. In my statement I am referring to NW 7.1 CE EHP1
1. Go to NetWeaver Administrator (http://<server>:port /nwa
2. Go to "Problem Management" section.
3. Go to the "Logs and Traces" section.
4. Go to the "Log Configuration" section.
5. Show "Logging Categories" from the drop down
     a. Logging Categories is the first area that needs to be changed and it basically states what levels of logs to write out.
6. Go down the path to Root Category -> Applications -> XMII
     a. I usually choose the XMII folder and set the logging level accordingly and then select "Copy to Subtree".
7. Choose the top drop down box again this time choose "Tracing Location"
      a. Tracing Location is what level of logs will be stored to be viewable in the log viewer.
8. Go down the path to Root Location -> com -> sap -> xmii
      a.   I usually choose the XMII folder and set the logging level accordingly and then select "Copy to Subtree".
Hope this helps.

How to get event's application log handle for application log mssg

Hi,
I would like to get the application log handle for an event call, can someone pls help.
Rgds.

Hello wong ,
Did u get the solution for this respective query.
if so can u please send it to me also .
i am struck over with the similar problem.
Thanks,
pavankumar.

Strange events in HH3 log

Similar Messages

Maybe you are looking for